Splunk rules: 21

name: Allow File And Printing Sharing In Firewall
id: ce27646e-d411-11eb-8a00-acde48001122
version: 15
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the modification of firewall settings to allow file and printer sharing. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving 'netsh' commands that enable file and printer sharing. This activity is significant because it can indicate an attempt by ransomware to discover and encrypt files on additional machines connected to the compromised host. If confirmed malicious, this could lead to widespread file encryption across the network, significantly increasing the impact of a ransomware attack.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    `process_netsh`
    Processes.process= "*firewall*"
    Processes.process= "*group=\"File and Printer Sharing\"*"
    Processes.process="*enable=Yes*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `allow_file_and_printing_sharing_in_firewall_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network admin may modify this firewall feature that may cause this rule to be triggered.
references:
    - https://community.fortinet.com:443/t5/FortiEDR/How-FortiEDR-detects-and-blocks-Revil-Ransomware-aka-sodinokibi/ta-p/189638?externalID=FD52469
    - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
finding:
    title: A suspicious modification of firewall to allow file and printer sharing detected on host - $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious modification of firewall to allow file and printer sharing detected on host - $dest$
analytic_story:
    - Ransomware
    - BlackByte Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Rare Executables
id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the execution of rare processes that appear only once across the network within a specified timeframe.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs.
    This activity is significant for a SOC as it helps identify potentially malicious activities or unauthorized software, which could indicate a security breach or ongoing attack.
    If confirmed malicious, such rare processes could lead to data theft, privilege escalation, or complete system compromise, making early detection crucial for minimizing impact.
    The search currently identifies processes executed on fewer than 10 hosts, but this threshold can be adjusted based on the organization's environment and risk tolerance.
    The search groups results by process name which can lead to blind spots if a malicious process uses a common name. To mitigate this, consider enhancing the detection logic to group by additional attributes such as process hash.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      dc(Processes.dest) as dc_dest
      values(Processes.dest) as dest
      values(Processes.user) as user
      min(_time) as firstTime
      max(_time) as lastTime
      latest(Processes.action) as action
      values(Processes.original_file_name) as original_file_name
      values(Processes.parent_process) as parent_process
      values(Processes.parent_process_exec) as parent_process_exec
      latest(Processes.parent_process_guid) as parent_process_guid
      latest(Processes.parent_process_id) as parent_process_id
      values(Processes.parent_process_name) as parent_process_name
      values(Processes.parent_process_path) as parent_process_path
      values(Processes.process) as process
      values(Processes.process_exec) as process_exec
      latest(Processes.process_guid) as process_guid
      values(Processes.process_hash) as process_hash
      values(Processes.process_path) as process_path
      latest(Processes.process_id) as process_id
      latest(Processes.process_integrity_level) as process_integrity_level
      latest(Processes.user_id) as user_id
      latest(Processes.vendor_product) as vendor_product
    from datamodel=Endpoint.Processes
    by Processes.process_name
    | `drop_dm_object_name(Processes)`
    | search dc_dest < 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_rare_executables_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Some legitimate processes may be only rarely executed in your environment.
    Apply additional filters as needed.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A rare process - [$process_name$] has been detected on less than 10 hosts on $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - China-Nexus Threat Activity
    - Unusual Processes
    - SnappyBee
    - Salt Typhoon
    - Rhysida Ransomware
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32841.62129'
title: Disabled Pre-Authentication Accounts Discovery - PowerShell
description: With the appropriate parameters, PowerShell cmdlets such as Get-ADUser
  or PowerView cmdlets including Get-DomainUser allow threat actors to discover domain
  accounts with Kerberos Pre-Authentication disabled, enabling them to target accounts
  vulnerable to Kerberos attacks such as AS-REP roasting. This use case detects PowerShell
  commands with parameters targeting accounts with Pre-Authentication disabled. PowerShell
  script block logging is recommended for best detection results. Detection using
  other log sources requires the PowerShell command to be run in a manner that creates
  a new process, such as powershell -command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<" OR Type=Process) ("Get-ADUser" ("4194304" OR "DoesNotRequirePreAuth"))
  OR ("Get-DomainUser" "PreauthNotRequired") OR "DONT_REQ_PREAUTH" | table _time,
  host, user process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:external remote services
- discovery:account discovery
technique_id: 
- T1133
- T1087
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://research.splunk.com/endpoint/114c6bfe-9406-11ec-bcce-acde48001122/
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/

name: Icacls Deny Command
id: cf8d753e-a8fe-11eb-8f58-acde48001122
version: 15
creation_date: '2021-05-07'
modification_date: '2026-09-01'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
    This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files.
    If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    From datamodel=Endpoint.Processes Where

    Processes.process_name IN (
        "icacls.exe",
        "cacls.exe",
        "xcacls.exe"
    )
    Processes.process IN (
        "*/deny*",
        "*/d:*",
        "*/d *"
    )

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `icacls_deny_command_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time. Filter as needed.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$].
        - field: user
          type: user
          score: 20
          message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$].
analytic_story:
    - Azorult
    - Sandworm Tools
    - Compromised Windows Host
    - XMRig
    - Crypto Stealer
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1222
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Service Started
id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a
version: 11
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious service started. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd`  proctitle IN ("*systemctl *", "*service *") AND proctitle IN ("* start*", "* enable*")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_service_started_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to start or enable a service.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '30750.54907'
title: Live Sysinternals Execution
description: Sysinternals utilities are a suite of advanced system utilities aimed
  at managing, troubleshooting, and diagnosing Windows systems and applications. The
  live version of Sysinternals, available from https://live.sysinternals.com, enables
  users to run the tools without having to first download and install them locally.
  Threat actors may leverage these tools for system reconnaissance, privilege escalation,
  or to facilitate lateral movement within a network. This use case detects command
  line invocations of live.sysinternals.com, indicating potential attempts to execute
  Sysinternals tools without installation.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "live.sysinternals.com" | regex process="(?i)live\.sysinternals\.com"
  | table _time, host, user, process, parent_process_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://live.sysinternals.com/
- https://learn.microsoft.com/en-us/sysinternals/

id: '6127.6610'
title: NMAP Execution
description: 'Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. This use case looks for executions of nmap that
  have been passed an IPv4 Address. -- Threat Actor Association: Alloy Taurus/Gallium'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(nmap) OR "nmap.exe") | table _time, host,
  user, signature_id, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:remote system discovery
technique_id: 
- T1018
data_category:
- Windows event logs
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

name: O365 Elevated Mailbox Permission Assigned
id: 2246c142-a678-45f8-8546-aaed7e0efd30
version: 13
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Patrick Bareiss, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the assignment of elevated mailbox permissions in an Office 365 environment via the Add-MailboxPermission operation. It leverages logs from the Exchange workload in the o365_management_activity data source, focusing on permissions such as FullAccess, ChangePermission, or ChangeOwner. This activity is significant as it indicates potential unauthorized access or control over mailboxes, which could lead to data exfiltration or privilege escalation. If confirmed malicious, attackers could gain extensive access to sensitive email data and potentially manipulate mailbox settings, posing a severe security risk.
data_source:
    - O365 Add-MailboxPermission
search: |-
    `o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner)
      | rename Identity AS dest_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           dest_user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_elevated_mailbox_permission_assigned_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: FullAccess mailbox delegation may be assigned for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/002/
    - https://learn.microsoft.com/en-us/powershell/module/exchange/add-mailboxpermission
    - https://learn.microsoft.com/en-us/exchange/recipients/mailbox-permissions?view=exchserver-2019
finding:
    title: Elevated mailbox permissions were assigned on $dest_user$
    entity:
        field: dest_user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: O365 Service Principal New Client Credentials
id: a1b229e9-d962-4222-8c62-905a8a010453
version: 13
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the addition of new credentials for Service Principals within an Office 365 tenant. It uses O365 audit logs, focusing on events related to credential modifications or additions in the AzureActiveDirectory workload. This activity is significant because Service Principals represent application identities, and their credentials allow applications to authenticate and access resources. If an attacker successfully adds or modifies these credentials, they can impersonate the application, leading to unauthorized data access, data exfiltration, or malicious operations under the application's identity.
data_source:
    - O365
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation="Update application*Certificates and secrets management "
      | fillnull
      | stats earliest(_time) as firstTime latest(_time) as lastTime
        BY user ModifiedProperties{}.NewValue object
           ObjectId dest signature
           src vendor_account vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_service_principal_new_client_credentials_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/001/
    - https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md#add-credentials-to-all-enterprise-applications
finding:
    title: New credentials added for Service Principal $object$
    entity:
        field: object
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: New credentials added for Service Principal $object$
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '15967.23906'
title: PowerShell Modifying Registry Values
description: 'Adversaries may interact with the Windows Registry to hide configuration
  information within Registry keys, remove information as part of cleaning up, or
  as part of other techniques to aid in persistence and execution. This use case detects
  PowerShell commands accessing or modifying the Current User or Local Machine registry
  hives. -- Threat Actor Association: CL-STA-0043 -- Atomics T1059.001 Test #11 Atomics
  T1546.008 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(Invoke-Expression) OR "IEX") ("HKLM" OR
  "HKEY_LOCAL_MACHINE" OR "HKCU" OR "HKEY_CURRENT_USER") | table _time, host, user
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:modify registry
- execution:command and scripting interpreter:powershell
technique_id:
- T1112
- T1059.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution

id: '5367.9863'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (("systemctl" OR "service") "stop")
  OR (type=service_stop TERM(success)) | table _time, host, user process, process_*,
  type, unit | bin span=1s | stats values(*) as * by _time, host | eventstats dc(host)
  as dc_host c(unit) as c_unit by unit| where match(process, "(?i)(systemctl|service)\s.*?stop")
  OR (match(type, "(?i)(service_stop)") AND dc_host < 3 AND c_unit < 10) '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Linux audit logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf

name: SLUI RunAs Elevated
id: 8d124810-b3e4-11eb-96c7-acde48001122
version: 12
creation_date: '2021-05-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Microsoft Software Licensing User Interface Tool (`slui.exe`) with elevated privileges using the `-verb runas` function. This activity is identified through logs from Endpoint Detection and Response (EDR) agents, focusing on specific registry keys and command-line parameters. This behavior is significant as it indicates a potential privilege escalation attempt, which could allow an attacker to gain elevated access and execute malicious actions with higher privileges. If confirmed malicious, this could lead to unauthorized system changes, data exfiltration, or further compromise of the affected endpoint.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `slui_runas_elevated_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives should be present as this is not commonly used by legitimate applications.
references:
    - https://www.exploit-db.com/exploits/46998
    - https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
    - https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466
    - https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
finding:
    title: A slui process $process_name$ with elevated commandline $process$ on host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A slui process $process_name$ with elevated commandline $process$ on host $dest$
analytic_story:
    - DarkSide Ransomware
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Splunk AppDynamics Secure Application Alerts
id: d1a45d84-8dd1-4b31-8854-62b0b1d5da0b
version: 5
creation_date: '2025-02-04'
modification_date: '2026-05-13'
author: Ryan Long, Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    The following analytic is to leverage alerts from Splunk AppDynamics SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality.

    Splunk AppDynamics SecureApp provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by:

    * Identifying active exploitation attempts in real-time, allowing for quicker incident response.
    * Categorizing attack severity to prioritize remediation efforts based on risk level.
    * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications.
    * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows.
    * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability.

    By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.
data_source:
    - Splunk AppDynamics Secure Application Alert
search: |-
    `appdynamics_security`  blocked=false
    | rename attackEvents{}.* AS *, detailJson.* AS *, vulnerabilityInfo.* AS *
    | fields - tag::eventtype, eventtype, host, id, index, linecount, punct, source, sourcetype, splunk_server, tag, SourceType, app clientAddressType, application, tier, "attackEvents{}.* status"
    | eval socketOut=mvjoin(socketOut," AND ")
    | eval risk_score=kennaScore
    | fillnull risk_score value="0"
    `secureapp_es_field_mappings`
    | stats values(*) as * by attackId
    | eval severity=case(
        risk_score>=100 OR signature="LOG4J", "critical",
        risk_score>50 AND risk_score<75, "high",
        risk_score=0 AND attackOutcome="EXPLOITED", "high",
        risk_score<=50 AND attackOutcome!="OBSERVED", "medium",
        risk_score=0 AND attackOutcome="ATTEMPTED", "medium",
        risk_score=0, "low",
        risk_score=0 AND attackOutcome="OBSERVED", "low"
        )
    | eval risk_message=case(
      (signature="API" OR signature="LOG4J" OR signature="SSRF"), "An attempt to exploit a ".signature." vulnerability was made from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed, and data may have been exfiltrated to ".socketOut.".",
      (signature="MALIP" OR signature="SQL"), "A vulnerability is being ".attackOutcome." from a ".src_category." IP address ".src_ip.". The server ".dest_nt_host." hosting application ".app_name." was accessed.",
      (signature="DESEREAL"), "The application ".app_name." deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Data which is untrusted cannot be trusted to be well-formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized."
      )
    | `splunk_appdynamics_secure_application_alerts_filter`
how_to_implement: In order to properly run this search, you need to ingest alerts data from AppD SecureApp, specifically ingesting data via HEC. You will also need to ensure that the data is going to sourcetype - `appdynamics_security`. You will need to install the Splunk Add-on for AppDynamics.
known_false_positives: No known false positives for this detection. If the alerts are noisy, consider tuning this detection by using the _filter macro in this search, and/or updating the tool this alert originates from.
references:
    - https://docs.appdynamics.com/appd/24.x/latest/en/application-security-monitoring/integrate-cisco-secure-application-with-splunk
intermediate_findings:
    entities:
        - field: app_name
          type: other
          score: 20
          message: $risk_message$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Critical Alerts
asset_type: Web Application
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: threat

id: '20632.36764'
title: Suspicious ntds.dit Commands
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case detects patterns of commands associated with ntds.dit dumping and/or exfiltration.
  -- Threat Actor Association: UNC5221, UTA0178 -- Software Association: Akira --
  Atomics T1003.003 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(ntdsutil) OR TERM(ntds) OR "ntds.dit") (((TERM(ac) TERM(i)) OR (TERM(activate)
  TERM(instance)) TERM(create) TERM(full)) OR TERM(copy)) | regex process="(?i)(ac\s+i\s+ntds.+create\s+full)|(copy\s+.+?ntds\.dit)|(activate\s+instance\s+ntds.*create\s+full)"
  | table _time, host, user, process*, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
- https://pentestlab.blog/tag/ntds-dit/
- https://github.com/zcgonvh/NTDSDumpEx
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1

name: Windows Alternate Data Stream Created Over Local Share
id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259
version: 1
creation_date: '2026-08-19'
modification_date: '2026-08-19'
author: Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1).
    It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
    Legitimate local processes access files directly rather than through a local SMB share.
    This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32.
    If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.
data_source:
    - Windows Event Log Security 5145
search: |-
    `wineventlog_security`
    EventCode=5145
    IpAddress="127.0.0.1"
    ObjectType="File"
    | regex RelativeTargetName="(?i)\:\w+$"
    | fillnull
    | rename IpAddress as dest_ip
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest dest_ip
         ShareName ShareLocalPath RelativeTargetName
         AccessMask src_user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_alternate_data_stream_created_over_local_share_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled.
    The Windows TA is also required.
    Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated.
known_false_positives: |-
    Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares.
    Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment.
references:
    - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
    - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An alternate data stream $RelativeTargetName$ was created over a loopback local share on $dest$
threat_objects:
    - field: dest
      type: system
    - field: RelativeTargetName
      type: file_path
    - field: src_user
      type: user
analytic_story:
    - RoguePlanet
asset_type: Endpoint
mitre_attack_id:
    - T1564.004
    - T1021.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DLL Search Order Hijacking Hunt with Sysmon
id: 79c7d1fc-64c7-91be-a616-ccda752efe81
version: 12
creation_date: '2022-08-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`'
how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup.
known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths.
references:
    - https://hijacklibs.net
analytic_story:
    - Qakbot
    - Windows Defense Evasion Tactics
    - Living Off The Land
    - Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Disable Toast Notifications
id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
version: 11
creation_date: '2022-06-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows registry that disable toast notifications. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" with a value set to "0x00000000". This activity is significant because disabling toast notifications can prevent users from receiving critical system and application updates, which adversaries like Azorult exploit for defense evasion. If confirmed malicious, this action could allow attackers to operate undetected, leading to prolonged persistence and potential further compromise of the system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may cause some false positive.
references:
    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: the registry for DisallowRun settings was modified to enable on $dest$
analytic_story:
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MSIExec Spawn WinDBG
id: 9a18f7c2-1fe3-47b8-9467-8b3976770a30
version: 13
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the unusual behavior of MSIExec spawning WinDBG. It detects this activity by analyzing endpoint telemetry data, specifically looking for instances where 'msiexec.exe' is the parent process of 'windbg.exe'. This behavior is significant as it may indicate an attempt to debug or tamper with system processes, which is uncommon in typical user activity and could signify malicious intent. If confirmed malicious, this activity could allow an attacker to manipulate or inspect running processes, potentially leading to privilege escalation or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=msiexec.exe Processes.process_name=windbg.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_msiexec_spawn_windbg_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will only be present if the MSIExec process legitimately spawns WinDBG. Filter as needed.
references:
    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Njrat Fileless Storage via Registry
id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c
version: 11
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious registry modifications indicative of NjRat's fileless storage technique. It leverages the Endpoint.Registry data model to identify specific registry paths and values commonly used by NjRat for keylogging and executing DLL plugins. This activity is significant as it helps evade traditional file-based detection systems, making it crucial for SOC analysts to monitor. If confirmed malicious, this behavior could allow attackers to persist on the host, execute arbitrary code, and capture sensitive keystrokes, leading to potential data breaches and further system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\[kl]" OR  Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_njrat_fileless_storage_via_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
finding:
    title: a suspicious registry entry related to NjRAT keylloging registry on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NjRAT
asset_type: Endpoint
mitre_attack_id:
    - T1027.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows System User Discovery Via Quser
id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0
version: 8
creation_date: '2022-12-13'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the Windows OS tool quser.exe, commonly used to gather information about user sessions on a Remote Desktop Session Host server. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as quser.exe is often abused by post-exploitation tools like winpeas, used in ransomware attacks to enumerate user sessions. If confirmed malicious, attackers could leverage this information to further compromise the system, maintain persistence, or escalate privileges.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="quser.exe"
        OR
        Processes.original_file_name = "quser.exe"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_system_user_discovery_via_quser_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can use this command tool to audit RDP access of user in specific network or host.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
analytic_story:
    - Prestige Ransomware
    - Crypto Stealer
    - Windows Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unusual NTLM Authentication Destinations By Source
id: ae9b0df5-5fb0-477f-abc9-47faf42aa91d
version: 10
creation_date: '2024-03-16'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when an unusual number NTLM authentications is attempted by the same source against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a multiple domain joined Windows devices using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well.
data_source:
    - NTLM Operational 8004
    - NTLM Operational 8005
    - NTLM Operational 8006
search: |
    `ntlm_audit`
    EventCode = 8004
    SChannelName=* WorkstationName=*
    ```CIM alignment, remove leading \\ from some auth attempts ```
    | eval src = replace(WorkstationName,"\\\\","")
    | eval dest = SChannelName, user = UserName

    ``` Remove NTLM auths to self, improves accuracy for certain applications ```
    | where SChannelName!=src

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  dc(eval(upper(dest))) as unique_count by src
    | eventstats avg(unique_count) as unique_avg
                 stdev(unique_count) as unique_std

    ``` adjust formula for sensitivity```
    | eval upperBound_unique=(1+unique_avg+unique_std*3)

    | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
    | where isOutlier==1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_unusual_ntlm_authentication_destinations_by_source_filter`
how_to_implement: The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.
known_false_positives: Vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
    - https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827
    - https://www.varonis.com/blog/investigate-ntlm-brute-force
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The device [$src$] attempted $count$ NTLM authentications against $unique_count$ destinations.
analytic_story:
    - Active Directory Password Spraying
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint