Splunk rules: 22

id: '1025.1025'
title: Create_Add Local_Domain User
description: 'Detects the addition of a nonprivileged user that is added to a privileged
  local or domain group, or when a user is created. -- Threat Actor Association: Alloy
  Taurus/Gallium, APT29, APT35/Phosphorus/Magic Hound, CL-STA-0043, DarkSide, BlackMatter,
  FIN12, Lapsus$, Lazarus, Phosphorus/Magic Hound/APT35, UNC2596 -- Software Association:
  Akira, Avos, Bazarloader, BianLian, Blackbyte, Blackcat/ALPHV, Cactus, Conti, Cring,
  Cuba, Hafnium, Insekt, Lockbit, Qakbot/Qbot, Royal, SmokedHAM, TargetCompany, Trigona,
  Vice Society - Atomics T1078.003 Test#1 Atomics T1136.001 Test#3 Atomics T1136.001
  Test#4 Atomics T1136.001 Test#6 Atomics T1136.002 Test#1 Atomics T1136.002 Test#2
  Atomics T1136.002 Test#3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 "net.exe" AND
  ("add" OR "remote") | rename hashes as file_hash | table _time, host, user event_id,
  file_hash, parent_process, parent_process_id, parent_process_name, parent_process_path,
  process, process_current_directory, process_id, process_name, process_path, signature_id,
  user_id | bin span=120s | stats values(*) as * by _time, host | where match(process,"(?i).add")
  AND match(process,"(?i)(\-u)|(user)|(localgroup)|(group)") '
techniques:
- persistence:account manipulation
- persistence:create account:local account
- persistence:create account:domain account
technique_id:
- T1098
- T1136.002
- T1136.001
data_category:
- Windows Sysmon
references:
- https://www.sans.org/reading-room/whitepapers/logging/paper/37367

name: Detect Baron Samedit CVE-2021-3156
id: 93fbec4e-0375-440c-8db3-4508eca470c4
version: 9
creation_date: '2021-01-28'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \\" command. This detection leverages logs from Linux systems, specifically searching for instances of the sudoedit command with the "-s" flag followed by a double quote. This activity is significant because it indicates an attempt to exploit a known vulnerability that allows attackers to gain root privileges. If confirmed malicious, this could lead to complete system compromise, unauthorized access to sensitive data, and potential data breaches.
data_source: []
search: '`linux_hosts` "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`'
how_to_implement: Splunk Universal Forwarder running on Linux systems, capturing logs from the /var/log directory. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potential Baron Samedit behavior on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Baron Samedit CVE-2021-3156
asset_type: Endpoint
cve:
    - CVE-2021-3156
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Rundll32 Inline HTA Execution
id: 91c79f14-5b41-11eb-ae93-0242ac130002
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of "rundll32.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on command-line arguments. This activity is significant as it is often associated with fileless malware or application whitelisting bypass techniques. If confirmed malicious, this could allow an attacker to execute arbitrary code, bypass security controls, and maintain persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32` (Processes.process=*vbscript*
        OR
        Processes.process=*javascript*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_rundll32_inline_hta_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
references:
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
    - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
finding:
    title: Suspicious rundll32.exe inline HTA execution on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Suspicious MSHTA Activity
    - NOBELIUM Group
    - Living Off The Land
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Domain Account Discovery with Wmic
id: 383572e0-04c5-11ec-bdcc-acde48001122
version: 12
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `wmic.exe` with command-line arguments used to query for domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns indicative of domain account discovery. This activity is significant as it often precedes lateral movement or privilege escalation attempts by adversaries. If confirmed malicious, this behavior could allow attackers to map out user accounts within the domain, facilitating further attacks and potentially compromising sensitive information.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/002/
finding:
    title: an instance of process $process_name$ with commandline $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: an instance of process $process_name$ with commandline $process$ on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Discovery
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '25100.46549'
title: Event Logs Queried for RDP Sessions
description: 'Threat actors may query Windows Terminal Services logs for RDP session
  information. - Example 1: During post-compromise reconnaissance activities, Lazarus
  was observed using wevtutil to query Windows Terminal Services logs for RDP sessions
  (Event Code 25) in order to gather session reconnection information. - Example 2:
  Threat actor tracked as Cluster Charlie (STAC1305) searched Windows Event Logs for
  Windows Remote Connection Manager event ID 1149 -- This use case detects commands
  querying Terminal Services logs for event 25 for user disconnection or event 1149
  for records of successful Remote Desktop Services (RDP) logon attempt. While threat
  actors will most likely be using wevtutil to perform the queries, it has been omitted
  from the logic to account for instances where it has been renamed. -- Threat Actor
  Association: Cluster Charlie (STAC1305), Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("qe" OR "Query-Event") "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
  ("EventID=25" OR "EventID=1149") | table _time, host, user, process, process_*,
  user, parent_process_name, parent_process_path | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:system information discovery
technique_id: 
- T1082
data_category:
- PowerShell logs
references:
- https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/
- https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/

id: '12911.18540'
title: IcedID Discovery Commands
description: IcedID may automatically run several initial discovery commands that
  provided environmental information about the host, network, and domain. This use
  case looks for a combination of those commands commonly seen after IcedID is executed.
  - Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("net.exe" OR "net1.exe" OR "ipconfig" OR "ipconfig.exe"
  OR "nltest" OR "nltest.exe" OR "systeminfo" OR "systeminfo.exe") | table _time,
  host, user process, process_*, signature_id, parent_* | bin span=60s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)systeminfo.exe") and match(process_name,
  "(?i)net1?.exe") and match(process_name, "(?i)nltest.exe") and match(process_name,
  "(?i)ipconfig.exe") '
techniques:
- discovery:permission groups discovery:domain groups
- discovery:network share discovery
- discovery:account discovery
- discovery:system information discovery
- collection:automated collection
technique_id:
- T1069.002
- T1135
- T1087
- T1082
- T1119
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2022/04/25/quantum-ransomware/

name: Kerberos User Enumeration
id: d82d4af4-a0bd-11ec-9445-3e22fbd008af
version: 13
creation_date: '2022-03-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects an unusual number of Kerberos Ticket Granting Ticket (TGT) requests for non-existing users from a single source endpoint. It leverages Event ID 4768 and identifies anomalies using the 3-sigma statistical rule. This behavior is significant as it may indicate an adversary performing a user enumeration attack against Active Directory. If confirmed malicious, the attacker could validate a list of usernames, potentially leading to further attacks such as brute force or credential stuffing, compromising the security of the environment.
data_source:
    - Windows Event Log Security 4768
search: |-
    `wineventlog_security` EventCode=4768 Status=0x6 TargetUserName!="*$"
      | bucket span=2m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
        BY _time, src_ip
      | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
        BY src_ip
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
      | search isOutlier=1
      | `kerberos_user_enumeration_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
references:
    - https://github.com/ropnop/kerbrute
    - https://attack.mitre.org/techniques/T1589/002/
    - https://redsiege.com/tools-techniques/2020/04/user-enumeration-part-3-windows/
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 20
          message: Potential Kerberos based user enumeration attack $src_ip$
analytic_story:
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1589.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious GCC Invocation Building Init Shared Object
id: 9dbf4a61-0493-43bd-932c-532ba7671a7a
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name IN (
        "*x86_64-linux-gnu-gcc*",
        "cc",
        "g++",
        "gcc-*",
        "gcc"
    )
    Processes.process="*-shared*"
    Processes.process="*-Wl,-init,*"
    Processes.process="*.so*"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_current_directory Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_gcc_invocation_building_init_shared_object_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users.
references:
    - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/
    - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot
finding:
    title: Suspicious GCC Invocation Building Init Shared Object identified on [$dest$] via [$process_name$] with the Command Line [$process$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
    - Linux Post-Exploitation
    - Linux Persistence Techniques
asset_type: Endpoint
cve:
    - CVE-2025-32463
mitre_attack_id:
    - T1129
    - T1068
    - T1608
    - T1027.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '19656.34273'
title: LSA Authentication Packages Registry Key Modified
description: 'Adversaries can use the autostart mechanism provided by Local Security
  Authority (LSA) authentication packages for persistence or privilege escalation
  by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\.
  The binary will then be executed by the system when the authentication packages
  are loaded. This use case detects modifications to registry values involving LSA
  authentication package configurations. -- Software Association: Cactus -- Atomics
  T1547.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=12) OR "<EventID>12<"
  OR TERM(EventCode=13) OR "<EventID>13<") ("HKLM" OR "HKEY_LOCAL_MACHINE") ("lsa"
  "Authentication Packages") | table _time, host, user, parent_process*, process,
  process_*, signature_id, user_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
technique_id:
- T1547.002
data_category:
- Windows Sysmon
references:
- https://www.crysys.hu/publications/files/skywiper.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.002/T1547.002.md#atomic-test-1---authentication-package

id: '36445.64010'
title: masscan Execution - Windows
description: Masscan is a high-performance, open-source network scanning tool designed
  to scan large ranges of IP addresses for open ports, offering similar functionality
  to Nmap but with significantly faster scanning capabilities. Threat actors may use
  port and vulnerability scanning tools to identify running services and potential
  exploits on remote hosts and network devices. This use case detects masscan executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(masscan) OR "masscan.exe") | regex process_name="(?i)masscan\.exe" | table
  _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
references:
- https://github.com/robertdavidgraham/masscan/tree/master
- https://attack.mitre.org/techniques/T1046/
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
- https://www.kali.org/tools/masscan/

id: '11280.17051'
title: Microsoft Diagnostic Tool "DogWalk" Package Path Traversal
description: The vulnerability lies in the Microsoft Diagnostic Tool's sdiageng.dll
  library, which takes the attacker-supplied folder path from the package configuration
  XML file inside the diagcab archive, and copies all files from that folder to a
  local temporary folder. During this process, it enumerates files in attacker's folder,
  gets the file name for each of them, then glues together the local temporary path
  and that file name to generate the local path on the computer where the file is
  to be created.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  ("msdt.exe" OR TERM(msdt)) AND ("/cab" OR ".diagcab") | table _time, host, user
  process, process_*, parent_*, signature_id, trun_cmd | bin span=1s | stats values(*)
  as * by _time, host | where match(process, "(?i)cab|diagcab") '
techniques:
- execution:user execution
technique_id: 
- T1204
data_category:
- Windows Sysmon
references:
- https://blog.0patch.com/2022/06/microsoft-diagnostic-tools-dogwalk.html

name: Network Connection Discovery With Netstat
id: 2cf5cc25-f39a-436d-a790-4857e5995ede
version: 8
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `netstat.exe` with command-line arguments to list network connections on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and parent processes. This activity is significant as both Red Teams and adversaries use `netstat.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map network connections, identify critical systems, and plan further lateral movement or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="netstat.exe"
        )
        (Processes.process=*-a*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `network_connection_discovery_with_netstat_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1049/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
analytic_story:
    - CISA AA22-277A
    - Windows Post-Exploitation
    - Active Directory Discovery
    - CISA AA23-347A
    - Prestige Ransomware
    - Qakbot
    - PlugX
    - Medusa Ransomware
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1049
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 DLP Rule Triggered
id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871
version: 10
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain.
data_source:
    - Office 365 Universal Audit Log
search: '`o365_management_activity` Operation=DLPRuleMatch | eval recipient = ''ExchangeMetaData.To{}'', signature_id = ''ExchangeMetaData.UniqueID'', signature = ''PolicyDetails{}.Rules{}.RuleName'' , src_user = UserId, reason =''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName'', result=''PolicyDetails{}.Rules{}.Actions{}'', file_name=case(NOT match(''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'',"Message Body"),''PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location'') | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by action dest user src vendor_account vendor_product src_user recipient signature_id reason | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_dlp_rule_triggered_filter` '
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy DLP rules through O365 security and compliance functions.
known_false_positives: WIll depending on accuracy of DLP rules, these can be noisy so tune appropriately.
references:
    - https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ triggered a Microsoft Office DLP rule.
analytic_story:
    - Data Exfiltration
asset_type: O365 Tenant
mitre_attack_id:
    - T1048
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Email Security Feature Changed
id: 4d28013d-3a0f-4d65-a33f-4e8009fee0ae
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when specific O365 advanced security settings are altered within the Office 365 tenant. If an attacker successfully disables O365 security settings, they can operate within the tenant with reduced risk of detection. This can lead to unauthorized data access, data exfiltration, account compromise, or other malicious activities without leaving a detailed audit trail.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") Operation IN ("*AntiPhish*","*SafeLink*","*SafeAttachment*","*Malware*")
      | rename Id as object_id, UserId as user, Operation as signature, ObjectId as object
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product signature
           object_id object
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_email_security_feature_changed_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Administrators might alter features for troubleshooting, performance reasons, or other administrative tasks. Filter as needed.
references:
    - https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: An O365 security object [$object$] was altered by user $user$ using $signature$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Multiple Service Principals Created by User
id: a34e65d0-54de-4b02-9db8-5a04522067f6
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in Azure Active Directory. This activity is significant as it may indicate a compromised user account or unauthorized actions, potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information.
data_source:
    - O365 Add service principal.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"User\" | eval displayName = object | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_user_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple OAuth applications were created by $src_user$ in a short period of time
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Okta Multi-Factor Authentication Disabled
id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
version: 13
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised valid account. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network.
data_source:
    - Okta
search: |-
    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
      WHERE sourcetype="OktaIM2:log" All_Changes.object_category=User
        AND
        All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate
      BY All_Changes.user All_Changes.result All_Changes.command
         sourcetype All_Changes.src All_Changes.dest
    | `drop_dm_object_name("All_Changes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `okta_multi_factor_authentication_disabled_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Legitimate use case may require for users to disable MFA. Filter lightly and monitor for any unusual activity.
references:
    - https://attack.mitre.org/techniques/T1556/
    - https://splunkbase.splunk.com/app/6553
finding:
    title: MFA was disabled for User [$user$] initiated by [$src$]. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Powershell Defender Threat Actions Set to Allow
id: 7dd3ced1-dc48-4998-9bc2-57e6ae5efaa7
version: 1
creation_date: '2026-05-12'
modification_date: '2026-05-12'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the setting of the Windows Defender Threat Actions to allow. It leverages data from the Endpoint.Processes data model, specifically monitoring the execution of the `Set-MpPreference` cmdlet with the `-HighThreatDefaultAction`, `-ModerateThreatDefaultAction`, `-LowThreatDefaultAction`, and `-SevereThreatDefaultAction` parameters set to `6`. This activity is significant because it is commonly used by malware such as RATs, bots, or Trojans to evade detection by allowing threats to pass through the Windows Defender antivirus engine. If confirmed malicious, this action could allow an attacker to execute malicious code without being detected by Windows Defender, leading to potential data exfiltration, further system compromise, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    `process_powershell`
    Processes.process="*Set-MpPreference*"
    (
      Processes.process IN (
        "*-HighThreatDefaultAction*",
        "*-ModerateThreatDefaultAction*",
        "*-LowThreatDefaultAction*",
        "*-SevereThreatDefaultAction*"
      )
      Processes.process IN (
        "* 6*"
      )
    )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_defender_threat_actions_set_to_allow_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives. However, tune based on scripts that may perform this action.
references:
    - https://www.broadcom.com/support/security-center/protection-bulletin/uac-0252-activity-delivering-shadowsniff-and-salatstealer-malware
    - https://bazaar.abuse.ch/browse/tag/SalatStealer/
finding:
    title: Process Commandline [$process$] that Set to Allow Windows Defender Threat Actions on [$dest$].
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credentials from Password Stores Chrome Copied in TEMP Dir
id: 4d14c86d-fdee-4393-94da-238d2706902f
version: 11
creation_date: '2024-10-18'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the copying of Chrome's Local State and Login Data files into temporary folders, a tactic often used by the Braodo stealer malware. These files contain encrypted user credentials, including saved passwords and login session details. The detection monitors for suspicious copying activity involving these specific Chrome files, particularly in temp directories where malware typically processes the stolen data. Identifying this behavior enables security teams to act quickly, preventing attackers from decrypting and exfiltrating sensitive browser credentials and mitigating the risk of unauthorized access.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("Local State", "Login Data") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_copied_in_temp_dir_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://x.com/suyog41/status/1825869470323056748
    - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
finding:
    title: Chrome Password Store File [$file_name$] was copied in %temp% folder on [$dest$].
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Braodo Stealer
    - Scattered Lapsus$ Hunters
    - BlankGrabber Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1555.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MSIExec DLLRegisterServer
id: fdb59aef-d88f-4909-8369-ec2afbd2c398
version: 14
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of msiexec.exe with the /y switch parameter, which enables the loading of DLLRegisterServer. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and parent-child process relationships. This activity is significant because it can indicate an attempt to register malicious DLLs, potentially leading to code execution or persistence on the system. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_msiexec` Processes.process IN ("* /y*", "* -y*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_msiexec_dllregisterserver_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
references:
    - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows System Binary Proxy Execution MSIExec
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Ngrok Reverse Proxy Usage
id: e2549f2c-0aef-408a-b0c1-e0f270623436
version: 13
creation_date: '2022-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_ngrok_reverse_proxy_usage_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present based on organizations that allow the use of Ngrok. Filter or monitor as needed.
references:
    - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A reverse proxy was identified spawning from $parent_process_name$ -  $process_name$ on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: A reverse proxy was identified spawning from $parent_process_name$ -  $process_name$ on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Reverse Network Proxy
    - CISA AA22-320A
    - CISA AA24-241A
asset_type: Endpoint
mitre_attack_id:
    - T1572
    - T1090
    - T1102
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Outlook Macro Created by Suspicious Process
id: 3ec347e3-a94a-4a8b-a918-8306ea403182
version: 4
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the creation of an Outlook Macro (VbaProject.OTM) by a suspicious process. This file is normally created when you create a macro from within Outlook. If this file is created by a process other than Outlook.exe it may be maliciously created. This detection leverages data from the Filesystem datamodel, specifically looking for the file creation event for VbaProject.OTM. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem where Filesystem.file_path="*Appdata\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_created_by_suspicious_process_filter`'
how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: Because this file are always created by Outlook in normal operations, you should investigate all results.
references:
    - https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
    - https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
finding:
    title: Suspicious Outlook macro $file_name$ created on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious Outlook macro $file_name$ created on $dest$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - NotDoor Malware
asset_type: Endpoint
mitre_attack_id:
    - T1137
    - T1059.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Create Service
id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9
version: 12
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the creation of a new service on a remote endpoint using sc.exe. It leverages data from Endpoint Detection and Response (EDR) agents, specifically monitoring for EventCode 7045, which indicates a new service creation. This activity is significant as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, this could allow the attacker to establish persistence, escalate privileges, or execute arbitrary code on the remote system, potentially leading to further compromise of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe Processes.process IN ("*create*")  Processes.process="*\\\\*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities.
references:
    - https://attack.mitre.org/techniques/T1543/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a remote service.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a remote service.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Lateral Movement
    - CISA AA23-347A
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint