Splunk rules: 20

id: '33144.58774'
title: Bash -c Execution - Windows
description: Bash is a popular default shell on Linux and macOS. Git Bash is a package
  that installs Bash, some common bash utilities, and Git on a Windows operating system.
  Bash is also included with Windows Subsystem for Linux. Bash is on the Microsoft
  recommended block list for executable files. This use case detects executions of
  bash.exe with -c.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "bash.exe" | regex process_name="(?i)bash\.exe"|
  regex process="(?i)\s+-[ilsx]*c[ilsx]*" | table _time, host, user, signature_id,
  process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host | where event_count < 5 '
techniques:
- defense-evasion:system binary proxy execution
- defense-evasion:system script proxy execution
technique_id: 
- T1218
- T1216
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Bash/

name: Cisco NVM - Outbound Connection to Suspicious Port
id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port.
    It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
    communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
    These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
            )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | lookup suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category
    | where isnotnull(dest_port_metadata)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___outbound_connection_to_suspicious_port_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools.
    However, many of these ports are commonly used by threat actors for reverse shells or C2 communications.
    Review the associated process and command-line context to determine intent.
references:
    - https://mthcht.medium.com/hunting-for-suspicious-ports-activities-50ef56d5cef
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The host $src$ established an outbound network connection via the process $process_path$ with the commandline arguments $process_arguments$ to $dest$ over suspicious port $dest_port$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1571
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1036.1046'
title: Command-Line Interface Execution
description: 'Detects when a Command-Line Interface executes on a host. -- Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT35/Phosphorus/Magic Hound,
  APT36, APT37, APT41, Carbanak, FamousSparrow, FIN6, FIN7, FIN8, Kimsuky, MalKamak,
  MuddyWater, Night Spider, TA,505, TA551, Prophet Spider, Wizard Spider, WIRTE --
  Software Association: Astaroth, BadHatch, Bazar, Conti, Cring, Emotet, GhostShell,
  Hafnium, Hancitor, Harvester, Hive, IcedID, MINEBRIDGE, MirrorBlast, MysterySnail,
  Nefilim, PowerShortShell, Prometheus / Spook, QakBot, Ransom Cartel, RATDispenser,
  Remcos, Ryuk, Sodinokibi/REvil, SquirrelWaffle, Trickbot, XingLocker, Zloader, Zumkong'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` EventCode=4103 ("powershell.exe"
  OR "cmd.exe") | table _time, host, user client, event_id, eventtype, host, index,
  parameters, process, process_name, process_path, shell, signature_id, source, sourcetype,
  tag, user, user_id | bin span=60s | stats values(*) as * by _time, host | where
  match(process,"(?i)powershell\.exe") OR match(process,"(i?)cmd\.exe") | fields -
  process '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://securityintelligence.com/an-increase-in-powershell-attacks-observations-from-ibm-x-force-iris/
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/tracking-detecting-and-thwarting-powershell-based-malware-and-attacks

id: '5463.5626'
title: ' comsvcs.dll Lsass Memory Dump'
description: 'Credential dumping within the lsass memory using Windows built-in comsvcs.dll
  file. When System32 crashes this DLL contains a function called minidumpw which
  dumps the lsass memory. This does not require additional tools like Mimikatz and
  Procdump in order to perform the lsass dump. -- Threat Actor Association: APT27,
  APT35/Phosphorus/Magic Hound, BlackCat, Lancefly, Lazarus, Volt Typhoon, Witchetty,
  Wizard Spider - Software Association: Akira, Conti, HermeticWiper/Trojan.Killdisk,
  Prestige, PYSA/Mespinoza, Vice Society - Atomics T1003 Test #3 Atomics T1003.001
  Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("rundll32.exe" OR "rundll32") ("comsvcs.dll"
  OR "comsvcs") ("dmp" OR "MiniDump" OR "DumpProc" OR "lsass.exe" OR "lsass" OR "#24")
  | table _time, host, user signature_id, user, process_id, process_name, process_path,
  process, parent_process_id, parent_process_name, parent_process_path | bin span=1s
  | stats values(*) as * by _time, host, process '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://en.hackndo.com/remote-lsass-dump-passwords/#manual-method--procdump

id: '32338.57517'
title: Consent.exe Suspicious Child Process
description: Consent.exe is a process created by Microsoft Windows that is responsible
  for managing User Account Control (UAC) consent. This use case detects any suspicious
  child process of consent.exe in attempt to escalate privileges.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "consent.exe" | regex parent_process_path="(?i):\x5cWindows\x5csystem32\x5cconsent\.exe"
  | regex process_path!="(?i):\x5cWindows\x5csystem32\x5cWerFault\.exe" | table _time,
  host, user, process, process_*, parent_* | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:command and scripting interpreter
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1059
- T1068
data_category:
- Windows Sysmon
references:
- https://blog.snapattack.com/hunting-cve-2024-30051-8de021f0cf77
- https://www.youtube.com/watch?v=G5tlqwWZdJA
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1548/002/

name: Detect Computer Changed with Anonymous Account
id: 1400624a-d42d-484d-8843-e6753e6e3645
version: 11
creation_date: '2020-09-18'
modification_date: '2026-05-13'
author: Rod Soto, Jose Hernandez, Splunk
status: production
type: Hunting
description: |
    The following analytic detects changes to computer accounts using an anonymous logon.
    It leverages Windows Security Event Codes 4742 (Computer Change) with a SubjectUserName of a value "ANONYMOUS LOGON".
    This activity can be significant because anonymous logons should not typically be modifying computer accounts, indicating potential unauthorized access or misconfiguration.
    If confirmed malicious, this could allow an attacker to alter computer accounts, potentially leading to privilege escalation or persistent access within the network.
data_source:
    - Windows Event Log Security 4742
search: |-
    `wineventlog_security`
    EventCode=4742
    SubjectUserName="ANONYMOUS LOGON"
    PasswordLastSet="*"
    | stats count min(_time) as firstTime max(_time) as lastTime
        BY action app dest ProcessID PasswordLastSet
           signature signature_id src_user status
           SubjectDomainName user user_group vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_computer_changed_with_anonymous_account_filter`
how_to_implement: |
    This search requires "Audit Computer Account Management" sub-category in the audit policy to be enabled on the system in order to generate Event ID 4742, as well as "Audit Logon" to generate Event ID 4624.
    We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs.
    Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: Some legitimate, legacy devices may utilize this functionality and generate false positives. Apply additional tuning as needed.
references:
    - https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
    - https://netwrix.com/en/cybersecurity-glossary/cyber-security-attacks/zerologon-vulnerability/
    - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Credential%20Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx
analytic_story:
    - Detect Zerologon Attack
asset_type: Windows
cve:
    - CVE-2020-1472
mitre_attack_id:
    - T1210
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Enable RDP In Other Port Number
id: 99495452-b899-11eb-96dc-acde48001122
version: 18
creation_date: '2021-05-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the registry that enable RDP on a machine using a non-default port number. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" and the "PortNumber" value. This activity is significant as attackers often modify RDP settings to facilitate lateral movement and maintain remote access to compromised systems. If confirmed malicious, this could allow attackers to bypass network defenses, gain persistent access, and potentially control the compromised machine.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
finding:
    title: RDP was moved to a non-standard port on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: RDP was moved to a non-standard port on $dest$ by $user$.
analytic_story:
    - Prohibited Traffic Allowed or Protocol Mismatch
    - Windows Registry Abuse
    - Windows RDP Artifacts and Defense Evasion
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1021
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Enable WDigest UseLogonCredential Registry
id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
version: 16
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is commonly used by malware and tools like Mimikatz to dump plain text credentials, indicating a potential credential dumping attempt. If confirmed malicious, this could allow an attacker to obtain sensitive credentials, leading to further compromise and lateral movement within the network.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
finding:
    title: wdigest registry $registry_path$ was modified on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: wdigest registry $registry_path$ was modified on $dest$
analytic_story:
    - Credential Dumping
    - Windows Registry Abuse
    - CISA AA22-320A
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GetDomainController with PowerShell Script Block
id: 676b600a-a94d-4951-b346-11329431e6c1
version: 12
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet is part of PowerView, a tool often used for domain enumeration. The detection leverages script block text to identify this specific activity. Monitoring this behavior is crucial as it may indicate an adversary or Red Team performing reconnaissance to map out domain controllers. If confirmed malicious, this activity could lead to further domain enumeration, potentially exposing sensitive information and aiding in lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `getdomaincontroller_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/
finding:
    title: Remote system discovery with PowerView on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Enterprise Disable IP Allow List
id: afed020e-edcd-4913-a675-cebedf81d4fb
version: 8
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies when an IP allow list is disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for actions related to disabling IP allow lists at the organization or enterprise level. This behavior is concerning because IP allow lists are a critical security control that restricts access to GitHub Enterprise resources to only trusted IP addresses. When disabled, it could indicate an attacker attempting to bypass access controls to gain unauthorized access from untrusted networks. The impact includes potential exposure of sensitive code repositories and GitHub Enterprise resources to access from any IP address. SOC teams should investigate such events, especially if they were not pre-approved changes, as they may indicate compromise of admin credentials or malicious insider activity.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=ip_allow_list.disable
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           user_agent, user_id, action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_disable_ip_allow_list_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ disabled an IP allow list in GitHub Enterprise
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: GitHub Organizations Repository Deleted
id: 9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies when a repository is deleted within a GitHub organization. The detection monitors GitHub Organizations audit logs for repository deletion events by tracking actor details, repository information, and associated metadata. This behavior is concerning for SOC teams as malicious actors may attempt to delete repositories to destroy source code, intellectual property, or evidence of compromise. Repository deletion can result in permanent loss of code, documentation, and project history if proper backups are not maintained. Additionally, unauthorized repository deletion could indicate account compromise, insider threats, or attempts to disrupt business operations. The impact of a repository deletion attack includes loss of intellectual property, disruption to development workflows, and potential financial losses from lost work. Early detection of unauthorized repository deletions allows security teams to investigate potential compromises and restore from backups if needed.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=repo.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           org, org_id, repo,
           repo_id, user_agent, visibility,
           vendor_action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_repository_deleted_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ deleted a repository in GitHub Organizations
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1485
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '17787.30036'
title: hh.exe Remote File Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. This use case detects hh.exe executions accessing a
  remote compiled HTML file. LOLBAS Atomics T1218.001 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(hh) OR TERM(hh.exe)) | where match(process_name, "(?i)hh\.exe") AND match(process,
  "(?i)\w+tps?://") | table _time, host, user process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-2---compiled-html-help-remote-payload
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/

name: Kerberos Pre-Authentication Flag Disabled with PowerShell
id: 59b51620-94c9-11ec-b3d5-acde48001122
version: 13
creation_date: '2022-02-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of the `Set-ADAccountControl` PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific command execution. Disabling Kerberos Pre-Authentication is significant because it allows adversaries to perform offline brute force attacks against user passwords using the AS-REP Roasting technique. If confirmed malicious, this activity could enable attackers to escalate privileges or maintain persistence within an Active Directory environment, posing a severe security risk.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes.
references:
    - https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
    - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
    - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
finding:
    title: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Shell Running on Worker Node
id: efebf0c4-dcf4-496f-85a2-5ab7ad8fa876
version: 10
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies shell activity within the Kubernetes privilege scope on a worker node. It leverages process metrics from an OTEL collector hostmetrics receiver, specifically process.cpu.utilization and process.memory.utilization, pulled from Splunk Observability Cloud. This activity is significant as unauthorized shell processes can indicate potential security threats, providing attackers an entry point to compromise the node and the entire Kubernetes cluster. If confirmed malicious, this activity could lead to data theft, service disruption, privilege escalation, lateral movement, and further attacks, severely compromising the cluster's security and integrity.
data_source: []
search: |-
    | mstats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization where `kubernetes_metrics` AND process.executable.name IN ("sh","bash","csh", "tcsh") by host.name k8s.cluster.name k8s.node.name process.pid process.executable.name span=10s
    | search process.cpu.utilization>0 OR process.memory.utilization>0
    | stats avg(process.cpu.utilization) as process.cpu.utilization avg(process.memory.utilization) as process.memory.utilization
      BY host.name k8s.cluster.name k8s.node.name
         process.pid process.executable.name
    | rename host.name as host
    | `kubernetes_shell_running_on_worker_node_filter`
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart/tree/main
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes shell running on worker node on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd File Permission Modification Via Chmod
id: 5f1d2ea7-eec0-4790-8b24-6875312ad492
version: 15
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: "Teoderick Contreras, Splunk, Ivar Nygård"
status: production
type: Anomaly
description: The following analytic detects suspicious file permission modifications using the `chmod` command, which may indicate an attacker attempting to alter access controls on critical files or directories. Such modifications can be used to grant unauthorized users elevated privileges or to conceal malicious activities by restricting legitimate access. By monitoring for unusual or unauthorized `chmod` usage, this analytic helps identify potential security breaches, allowing security teams to respond promptly to prevent privilege escalation, data tampering, or other unauthorized actions on the system.
data_source:
    - Linux Auditd Proctitle
search: "`linux_auditd` proctitle=\"*chmod*\" AND proctitle IN (\"* 777 *\", \"* 755 *\", \"*+*x*\", \"* 754 *\")\n  | rename host as dest\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY proctitle dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `linux_auditd_file_permission_modification_via_chmod_filter`"
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A $proctitle$ event occurred on host $dest$ to modify file permissions using the "chmod" command.
analytic_story:
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
    - Linux Living Off The Land
    - XorDDos
    - Salt Typhoon
    - Linux Privilege Escalation
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1222.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Busybox Privilege Escalation
id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of BusyBox with sudo privileges, which can lead to privilege escalation on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where BusyBox is executed with both 'sh' and 'sudo' commands. This activity is significant because it indicates a user may be attempting to gain root access, bypassing standard security controls. If confirmed malicious, this could allow an attacker to execute arbitrary commands as root, leading to full system compromise and potential persistence within the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*busybox*"
        AND
        Processes.process="*sh*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_busybox_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/busybox/
    - https://man.archlinux.org/man/busybox.1.en
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Puppet Privilege Escalation
id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of Puppet commands with elevated privileges, specifically when Puppet is used to apply configurations with sudo rights. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access and execute system commands as the root user. If confirmed malicious, this could allow an attacker to fully compromise the system, execute arbitrary commands, and maintain persistent control.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*puppet*"
        AND
        Processes.process="*apply*"
        AND
        Processes.process="*-e*"
        AND
        Processes.process="*exec*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_puppet_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/puppet/
    - https://en.wikipedia.org/wiki/Puppet_(software)
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ollama Possible RCE via Model Loading
id: 3f28c930-5208-425d-a7b9-53d349756d91
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes.
data_source:
    - Ollama Server
search: '`ollama_server` level=ERROR ("*llama runner*" OR "*model*" OR "*server.go*" OR "*exited*") | rex field=_raw "source=(?<code_source>[^\s]+)" | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "err=\"(?<err>[^\"]+)\"" | rex field=_raw "level=(?<log_level>\w+)" | eval error_type=case( match(_raw, "exited"), "service_crash", match(_raw, "model"), "model_error", match(_raw, "llama runner"), "runner_error", 1=1, "unknown_error" ) | bin _time span=1h | stats count as error_count, earliest(_time) as first_error, latest(_time) as last_error, values(msg) as error_messages, values(err) as error_details, values(code_source) as code_sources, values(error_type) as error_types, dc(error_type) as unique_error_types by host | where error_count > 0 | eval first_error=strftime(first_error, "%Y-%m-%d %H:%M:%S") | eval last_error=strftime(last_error, "%Y-%m-%d %H:%M:%S") | eval severity=case( match(error_details, "exit status") OR error_count > 5, "critical", error_count > 2, "high", 1=1, "medium" ) | eval attack_type="Suspicious Model Loading / Potential RCE" | stats count by first_error, last_error, host, code_sources, error_count, unique_error_types, error_types, error_messages, error_details, severity, attack_type | `ollama_possible_rce_via_model_loading_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Corrupted model files from interrupted downloads, insufficient disk space or memory during legitimate model loading, incompatible model formats or versions, network timeouts when pulling models from registries, file permission issues in multi-user environments, or genuine configuration errors during initial Ollama setup may generate similar error patterns during normal operations.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Suspicious model loading errors detected on $host$ with $error_count$ failures showing error messages $error_messages$, potentially indicating malicious model injection, path traversal exploitation, or attempts to achieve remote code execution through crafted model files.
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Powershell Execute COM Object
id: 65711630-f9bf-11eb-8d72-acde48001122
version: 12
creation_date: '2021-08-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a COM CLSID through PowerShell. It leverages EventCode 4104 and searches for specific script block text indicating the creation of a COM object. This activity is significant as it is commonly used by adversaries and malware, such as the Conti ransomware, to execute commands, potentially for privilege escalation or bypassing User Account Control (UAC). If confirmed malicious, this technique could allow attackers to gain elevated privileges or persist within the environment, posing a significant security risk.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_execute_com_object_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: network operrator may use this command.
references:
    - https://threadreaderapp.com/thread/1423361119926816776.html
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
finding:
    title: A suspicious powershell script contains COM CLSID command on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1546.015
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 Shimcache Flush
id: a913718a-25b6-11ec-96d3-acde48001122
version: 13
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a suspicious rundll32 command line used to clear the shim cache. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because clearing the shim cache is an anti-forensic technique aimed at evading detection and removing forensic artifacts. If confirmed malicious, this action could hinder incident response efforts, allowing an attacker to cover their tracks and maintain persistence on the compromised machine.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32`
        AND
        Processes.process = "*apphelp.dll,ShimFlushCache*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `rundll32_shimcache_flush_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://blueteamops.medium.com/shimcache-flush-89daff28d15e
finding:
    title: rundll32 process execute $process$ to clear shim cache on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: rundll32 process execute $process$ to clear shim cache on $dest$
analytic_story:
    - Unusual Processes
    - Living Off The Land
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Sqlite Module In Temp Folder
id: 0f216a38-f45f-11eb-b09c-acde48001122
version: 11
creation_date: '2021-08-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of sqlite3.dll files in the %temp% folder. It leverages Sysmon EventCode 11 to identify when these files are written to the temporary directory. This activity is significant because it is associated with IcedID malware, which uses the sqlite3 module to parse browser databases and steal sensitive information such as banking details, credit card information, and credentials. If confirmed malicious, this behavior could lead to significant data theft and compromise of user accounts.
data_source:
    - Sysmon EventID 11
search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path  process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.cisecurity.org/insights/white-papers/security-primer-icedid
finding:
    title: Process creates a file $file_name$ in host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - IcedID
    - Lokibot
asset_type: Endpoint
mitre_attack_id:
    - T1005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '17711.29614'
title: Suspicious Conhost.exe Commands
description: 'Adversaries may abuse utilities that allow for command execution to
  bypass security restrictions that limit the use of command-line interpreters. This
  use case detects commands using conhost.exe to launch other executables, which may
  be used by adversaries to evade detection and bypass restrictions. -- Software Association:
  Qakbot -- Atomics T1202 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(conhost) | regex process="(?i)conhost\.exe.*?\.exe"| rex field=process "(?i)conhost\.exe\s+\"(?<spawned_process>[^\"]+)\.exe"
  | table _time, host, user parent_*, process, process_*, signature_id, spawned_process|
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- defense-evasion:exploitation for defense evasion
technique_id: 
- T1202
- T1211
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1202/T1202.md#atomic-test-3---indirect-command-execution---conhostexe