Splunk rules: 23

id: '6146.6663'
title: Adfind Commands
description: 'AdFind is a free command-line query tool that can be used for gathering
  information from Active Directory. In some instances Adversaries have renamed adfind
  in order to avoid detection. This use case looks for common commands of Adfind.
  -- Threat Actor Association: APT29/Nobelium/Cozy Bear, BlackMatter, Conti, DarkSide,
  FIN6, FIN7, FIN12, Karakurt, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Traveling Spider, Wizard Spider, Yanluowang -- Software
  Association: BazarLoader, Blackcat/ALPHV, Conti, DatopLoader, Dridex, Entropy, Lockbit,
  Nefilim, Quantum, Sodinokibi/REvil, Trickbot, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("objectcategory" OR "trustdmp" OR ("member" "list"))
  | regex process="(?i)(objectcategory|trustdmp|member\s(.*)?-list)" | table _time,
  host, user user, process, process_*, parent_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:domain trust discovery
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1087.002
- T1069.002
- T1482
- T1016
- T1018
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

id: '23090.41563'
title: AutoIt Execution
description: 'AutoIt is a freeware scripting utility that can automate Windows GUI
  tasks such as mouse clicks, keystrokes, and window manipulations. While it is a
  legitimate tool, threat actors have abused it to automate malicious activity. This
  use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3
  files. -- Software Association: DarkGate'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process)) ("AutoIT3.exe" OR "AutoIT2.exe" OR "AutoIT.exe"
  OR ".au3") | regex process="(?i)\S+\.exe.+\.au3" | table _time, host, user, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://isc.sans.edu/forums/diary/KPOT+Deployed+via+AutoIt+Script/25934/
- https://blog.talosintelligence.com/magnat-campaigns-use-malvertising-to/
- https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

name: Detect Software Download To Network Device
id: cc590c66-f65f-48f2-986a-4797244762f8
version: 9
creation_date: '2020-10-28'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic identifies unauthorized software downloads to network devices via TFTP, FTP, or SSH/SCP. It detects this activity by analyzing network traffic events on specific ports (69, 21, 22) from devices categorized as network, router, or switch. This activity is significant because adversaries may exploit netbooting to load unauthorized operating systems, potentially compromising network integrity. If confirmed malicious, this could lead to unauthorized control over network devices, enabling further attacks, data exfiltration, or persistent access within the network.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE (
            All_Traffic.transport=udp
            AND
            All_Traffic.dest_port=69
        )
        OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch
      BY All_Traffic.src All_Traffic.dest All_Traffic.dest_port
    | `drop_dm_object_name("All_Traffic")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_software_download_to_network_device_filter`
how_to_implement: This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory.
known_false_positives: This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.
references: []
finding:
    title: Potentially unauthorized software download to $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Router and Infrastructure Security
asset_type: Infrastructure
mitre_attack_id:
    - T1542.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Disabled Kerberos Pre-Authentication Discovery With PowerView
id: b0b34e2c-90de-11ec-baeb-acde48001122
version: 15
creation_date: '2022-02-18'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainUser` commandlet with the `-PreauthNotRequired` parameter using PowerShell Script Block Logging (EventCode=4104). This command is part of PowerView, a tool used for enumerating Windows Active Directory networks. Identifying domain accounts with Kerberos Pre-Authentication disabled is significant because adversaries can leverage this information to attempt offline password cracking. If confirmed malicious, this activity could lead to unauthorized access to domain accounts, potentially compromising sensitive information and escalating privileges within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use PowerView for troubleshooting
references:
    - https://attack.mitre.org/techniques/T1558/004/
    - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
    - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
finding:
    title: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Previously Unseen Process
id: c8119b2f-d7f7-40be-940a-1c582870e8e2
version: 10
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud. This detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
data_source: []
search: |-
    | mstats  count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-1h by host.name k8s.cluster.name k8s.node.name process.executable.name
    | eval current="True"
    | append [mstats  count(process.memory.utilization) as process.memory.utilization_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by host.name k8s.cluster.name k8s.node.name process.executable.name ]
    | stats count values(current) as current
      BY host.name k8s.cluster.name k8s.node.name
         process.executable.name
    | where count=1 and current="True"
    | rename host.name as host
    | `kubernetes_previously_unseen_process_filter`
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Previously Unseen Process on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: LLM Model File Creation
id: 23e5b797-378d-45d6-ab3e-d034ca12a99b
version: 3
creation_date: '2025-11-24'
modification_date: '2026-07-15'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Hunting
description: |
    Detects the creation of Large Language Model (LLM) files on Windows endpoints by monitoring file creation events for specific model file formats and extensions commonly used by local AI frameworks.
    This detection identifies potential shadow AI deployments, unauthorized model downloads, and rogue LLM infrastructure by detecting file creation patterns associated with quantized models (.gguf, .ggml), safetensors model format files, and Ollama Modelfiles.
    These file types are characteristic of local inference frameworks such as Ollama, llama.cpp, GPT4All, LM Studio, and similar tools that enable running LLMs locally without cloud dependencies.
    Organizations can use this detection to identify potential data exfiltration risks, policy violations related to unapproved AI usage, and security blind spots created by decentralized AI deployments that bypass enterprise governance and monitoring.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly` count
        min(_time) as firstTime
        max(_time) as lastTime
    from datamodel=Endpoint.Filesystem where

    (
        Filesystem.file_name IN (
            "*.gguf",
            "*.safetensors",
            "*ggml.dll",
            "*modelfile*"
        )
        OR
        (
            Filesystem.file_name = "ggml-*"
            Filesystem.file_name = "*.dll"
        )
    )
    NOT Filesystem.file_name IN (
        "__PSScriptPolicyTest*",
        "*.csv",
        "*.doc",
        "*.docx",
        "*.jpeg",
        "*.jpg",
        "*.pdf",
        "*.png",
        "*.ppt",
        "*.pptx",
        "*.py",
        "*.xls",
        "*.xlsx",
        "*Bentley.Civil*"
    )
    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
       Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
       Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `llm_model_file_creation_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints.
    Ensure that the Endpoint data model is properly populated with filesystem events from EDR agents or Sysmon Event ID 11.
    The logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
    The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model.
    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    Legitimate creation of LLM model files by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where model file creation is expected. Automated ML pipelines and workflows that generate or update model files as part of their normal operation. Third-party applications and services that manage or cache LLM model files for legitimate purposes.
references:
    - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
    - https://www.ibm.com/think/topics/shadow-ai
    - https://www.splunk.com/en_us/blog/artificial-intelligence/splunk-technology-add-on-for-ollama.html
    - https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
analytic_story:
    - Suspicious Local LLM Frameworks
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35820.62794'
title: Mega Utility Execution - Windows
description: Mega is a cloud storage service used by many threat actors due to its
  use of end-to-end encryption and semi-anonymous payment options. The client application
  MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate
  large amounts of data. This use case detects process executions of MEGASync or MegaCMD.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "Megasync.exe" OR "megacmd" | regex process_name="(?i)megasync\.exe|megacmd" | table
  _time, host, user process, process_*, parent_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/threat-detection/rclone-mega-extortion/
- https://mega.io/

name: MOVEit Empty Key Fingerprint Authentication Attempt
id: 1a537acc-199f-4713-b5d7-3d98c05ab932
version: 7
creation_date: '2024-07-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This detection identifies attempts to authenticate with an empty public key fingerprint in Progress MOVEit Transfer, which is a key indicator of potential exploitation of the CVE-2024-5806 vulnerability. Such attempts are characteristic of the authentication bypass technique used in this vulnerability, where attackers try to impersonate valid users without providing proper credentials. While occasional empty key fingerprint authentication attempts might occur due to misconfigurations, a sudden increase or attempts from unexpected sources could signify malicious activity. This analytic helps security teams identify and investigate potential exploitation attempts of the MOVEit Transfer authentication bypass vulnerability.
data_source: []
search: |-
    `moveit_sftp_logs` "UserAuthRequestHandler: SftpPublicKeyAuthenticator: Attempted to authenticate empty public key fingerprint"
      | stats count
        BY source _raw
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `moveit_empty_key_fingerprint_authentication_attempt_filter`
how_to_implement: The MOVEit logs must be collected in Splunk. Currently, there is no TA available for MOVEit. Modify the analytic as needed to match the log format of your environment.
known_false_positives: False positives may occur, therefore utilize the analytic as a jump off point to identify potential empty key fingerprint authentication attempts.
references:
    - https://labs.watchtowr.com/auth-bypass-in-un-limited-scenarios-progress-moveit-transfer-cve-2024-5806/
analytic_story:
    - MOVEit Transfer Authentication Bypass
    - Hellcat Ransomware
asset_type: Web Server
cve:
    - CVE-2024-5806
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Non Firefox Process Access Firefox Profile Dir
id: e6fc13b0-1609-11ec-b533-acde48001122
version: 21
creation_date: '2021-09-15'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information. If confirmed malicious, this behavior could lead to data exfiltration, unauthorized access to user accounts, and further compromise of the affected system.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) ObjectName="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: other browser not listed related to firefox may catch by this rule.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a non firefox browser process $ProcessName$ accessing $ObjectName$
analytic_story:
    - StealC Stealer
    - DarkGate Malware
    - CISA AA23-347A
    - NjRAT
    - Phemedrone Stealer
    - Azorult
    - Salt Typhoon
    - Remcos
    - Warzone RAT
    - Quasar RAT
    - 3CX Supply Chain Attack
    - AgentTesla
    - RedLine Stealer
    - SnappyBee
    - Malicious Inno Setup Loader
    - FIN7
    - Snake Keylogger
    - China-Nexus Threat Activity
    - 0bj3ctivity Stealer
    - Lokibot
    - BlankGrabber Stealer
    - VIP Keylogger
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1555.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5026.5077'
title: Rare Process Execution
description: 'Rare process executions are anomalies within an organization and are
  normally worth looking at. Although these kinds of detections can be false positive
  prone, they can be utilized as supporting evidence or as a last resort to detect
  malicious activity your other detection content may be missing. -- Threat Actor
  Association: Traveling Spider, Volt Typhoon, Wizard Spider - Software Association:
  Conti, Nefilim, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") NOT (New_Process_Name IN ("C:\\Program Files*","C:\\Windows\\SoftwareDistribution\\Download\\Install\\*","C:\\ProgramData\\Microsoft\\Windows
  Defender\\platform*") OR Creator_Process_Name IN ("C:\\Program Files*","C:\\Windows\\SoftwareDistribution\\Download\\Install\\*"))|
  rex field=process_path "^(?<process_path_ext>.+)\x5c[^\x5c]+$"| fields _time, host,
  user, process, process_*, parent_*`group_events("host, process_name", 10)` | eventstats
  dc(host) as dc_host by process_name| eventstats c(process_path_ext) as c_process_path_ext
  by process_path_ext| eventstats c(process) as c_process by process| where process_path!=parent_process_path
  and (dc_host=1 and c_process_path_ext<3 and c_process<3)`hec_collect`'
techniques:
- execution:command and scripting interpreter:windows command shell
- execution:user execution:malicious file
technique_id:
- T1204.002
- T1059.003
data_category:
- Windows event logs
references:
- https://www.splunk.com/en_us/blog/security/detecting-early-signs-of-compromise-using-windows-sysinternal.html
- https://d1zq5d3dtjfcoj.cloudfront.net/F-Secure-APT29-9985.png

id: '6732.8200'
title: Registry key added with reg.exe
description: 'Reg is a Windows utility used to interact with the Windows Registry.
  It can be used at the command-line interface to add information. -- Threat Actor
  Association: APT35/Phosphorus/Magic Hound, APT37, APT41, FIN6, Flax Typhoon, Gorgon
  Group, Harvester, Lazarus, TA428, UNC2465, Vice Society, Witchetty -- Software Association:
  BianLian, BlackByte, Blackcat/ALPHV, Conti, Hive, Lorenz, Prestige, SmokedHAM, Snatch,
  Sodinokibi/REvil, Remcos, WIRTE, Vice Society, XingLocker, Zumkong -- Atomics T1021.001
  Test #4 Atomics T1546.010 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "reg" ("add" OR "import") | table _time, host, user user, process, process_*, parent_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/

name: Registry Keys Used For Privilege Escalation
id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to registry keys under "Image File Execution Options" that can be used for privilege escalation. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths and values like GlobalFlag and Debugger. This activity is significant because attackers can use these modifications to intercept executable calls and attach malicious binaries to legitimate system binaries. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges, leading to potential system compromise and persistent access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.
references:
    - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/
finding:
    title: A registry activity in $registry_path$ related to privilege escalation in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A registry activity in $registry_path$ related to privilege escalation in host $dest$
analytic_story:
    - Cloud Federated Credential Abuse
    - Hermetic Wiper
    - Windows Privilege Escalation
    - Windows Registry Abuse
    - Data Destruction
    - Suspicious Windows Registry Activities
asset_type: Endpoint
mitre_attack_id:
    - T1546.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5977.6322'
title: regsvr32 Execution
description: 'Using regsvr32.exe, an adversary may load malicious .dll files. -- Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Association: Kimsuky,
  TA551, Traveling Spider, Wizard Spider -- Software Association: Astaroth, Bazar,
  Black Basta, Conti, HermeticWizard, IcedID, Nefilim, Qakbot/Qbot, Rhysida, XingLocker,
  Zloader Atomics T1218.010 Test#1 Atomics T1218.010 Test#2 Atomics T1218.010 Test#3
  Atomics T1218.010 Test#4 Atomics T1218.010 Test#5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4688) OR "<EventID>4688<"
  OR Type=Process TERM(regsvr32) | regex process="(?i)(regsvr32)"| table _time, host,
  user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host | where dc_process
  < 10 '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- https://www.carbonblack.com/blog/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/

name: Socat Remote TCP Connection with Local Echo Disabled
id: 458c6c37-116d-4f01-8267-f09f5b82cd14
version: 1
creation_date: '2026-08-27'
modification_date: '2026-08-27'
author: Maria Jose Erquiaga, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled.
    This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging.
    When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity.
data_source:
    - Osquery Results
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name="socat*"
    Processes.process="*echo=0*"
    Processes.process IN (
        "*openssl:*",
        "*tcp:*",
        "*tcp4:*",
        "*tcp6:*"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `socat_remote_tcp_connection_with_local_echo_disabled_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/techniques/T1059
    - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/
    - https://gtfobins.github.io/gtfobins/socat/
    - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Socat was executed with local terminal echo disabled and a remote TCP or OpenSSL connection via Command Line [$process$] on endpoint [$dest$] by user [$user$].
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1059
    - T1572
product:
    - Splunk Cloud
    - Splunk Enterprise
    - Splunk Enterprise Security
category: endpoint
security_domain: endpoint

id: '41487.76910'
title: Suspicious reCAPTCHA Command Line
description: This use case detects commonly abused LOLBAS utilities referencing reCAPTCHA
  in the command line.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR (TERM(EventCode=4104) OR "<EventID>4104<")) (TERM(reCAPTCHA)
  OR TERM(robot) OR TERM(human)) | where match(process, "(?i)\sreCAPTCHA\s|I\s+am\s+not\s+a\s+robot|Verify\s+you\s+are\s+human")
  | table _time, host, user parent_*, process_*, process| bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- execution:command and scripting interpreter
technique_id: 
- T1218
- T1059
data_category:
- PowerShell logs
references:
- https://www.reliaquest.com/blog/using-captcha-for-compromise/
- https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection

id: '40420.73843'
title: Visual Studio Code Tunnel Execution
description: Adversaries may communicate using application layer protocols associated
  with web traffic to avoid detection/network filtering by blending in with existing
  traffic. Commands to the remote system, and often the results of those commands,
  will be embedded within the protocol traffic between the client and server. This
  use case detects the execution of Visual Studio Code tunnel in attempt to establish
  a C2 channel, accounting for instances where the binary has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "tunnel" OR ("tunnel" ("--name " "--accept-server-license-terms")
  OR "--cli-data-dir") OR ("cmd.exe" " /d " " /c " "\\servers\\Stable-" "code-server.cmd")
  | where match(process, "(?i)\.exe(\x22)?\s+tunnel\s?") or ((match(process, "\.exe(\x22)?\s+tunnel\s?$")
  and like(process, "%--name %") and like(process, "%--accept-server-license-terms%"))
  or like(process, "%--cli-data-dir%") or (like(process_path, "%cmd.exe") and like(process,
  "% /d %") and like(process, "% /c %") and like(process, "%\\servers\\Stable-%")
  and like(process, "%code-server.cmd%"))) | table _time, host, user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:application layer protocol:web protocols
technique_id:
- T1071.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_vscode_tunnel_execution/
- https://attack.mitre.org/techniques/T1071/001/
- https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/

name: Windows AD Cross Domain SID History Addition
id: 41bbb371-28ba-439c-bb5c-d9930c28365d
version: 12
creation_date: '2022-09-08'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic detects changes to the sIDHistory attribute of user or computer objects across different domains. It leverages Windows Security Event Codes 4738 and 4742 to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute allows users to inherit permissions from other AD accounts, which can be exploited by adversaries for inter-domain privilege escalation and persistence. If confirmed malicious, this could enable attackers to gain unauthorized access to resources, maintain persistence, and escalate privileges across domain boundaries.
data_source:
    - Windows Event Log Security 4742
    - Windows Event Log Security 4738
search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)" | rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-|\\\)" | where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest | `windows_ad_cross_domain_sid_history_addition_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and  `Audit Computer Account Management` within `Account Management` all need to be enabled.
known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic.
references:
    - https://adsecurity.org/?p=1772
    - https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN
    - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute
finding:
    title: Active Directory SID History Attribute was added to $user$ by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Active Directory SID History Attribute was added to $user$ by $src_user$
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1134.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Binary Execution from an Archive
id: 1516a16f-391e-457f-b9a3-a81dfdf218a6
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Nasreddine Bencherchali, Splunk
status: experimental
type: Anomaly
description: |-
    Detects the execution of a binary from archive-related paths in the user's Temp directory.
    It looks for binaries launched by `explorer.exe`, `winrar.exe`, or `7zFM.exe`, where the executed process path includes Temp and archive markers such as RAR, 7z, or ZIP.
    This was abused by attackers to bypass Mark-of-the-Web (MOTW) such as CVE-2025-0411 or exploit certain vulnerabilities.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_name IN (
        "explorer.exe",
        "winrar.exe",
        "7zFM.exe"
    )
    Processes.process_path="*\\AppData\\Local\\Temp\\*"
    Processes.process_path IN (
        "*\\rar*",
        "*\\7z*",
        "*.zip*"
    )

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id
       Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_binary_execution_from_an_archive_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some installers, administrative packages, or automation workflows may extract and run binaries from archive files in temporary directories. Review the parent process, executed path, and user context before tuning approved activity.
references:
    - https://redcanary.com/threat-detection-report/threats/scarlet-goldfinch/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $process_name$ executed from an archive-related Temp path $process_path$ by $parent_process_name$ on $dest$ using command line $process$.
        - field: user
          type: user
          score: 20
          message: $process_name$ executed from an archive-related Temp path $process_path$ by $parent_process_name$ on $dest$ using command line $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
    - field: process_path
      type: file_path
analytic_story:
    - Spearphishing Attachments
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5685.5946'
title: Windows Copy Files
description: 'Adversaries may search local system sources, such as file systems or
  local databases, or network shares to find files of interest and sensitive data
  prior to Exfiltration. Interactive command shells may be in use, and common functionality
  within cmd may be used to gather information. These events are only detected when
  a new process is created, or if powershell logging is enabled and used. Threat Actor
  Association: APT29, Evilnum, REvil, TA428, Vice Society Software Association: Black
  Basta, SamSam Atomics T1505.003 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(copy) OR TERM(xcopy) OR TERM(robocopy))
  | regex process="(?i)(((^|\s+)copy|(xcopy|robocopy)(\.exe)?\"?)\s+)" | table _time,
  host, user signature_id, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- collection:data from local system
- execution:command and scripting interpreter
- collection:data from network shared drive
technique_id: 
- T1005
- T1059
- T1039
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://book.hacktricks.xyz/exfiltration
- https://www.computerhope.com/xcopyhlp.htm

name: Windows Disable or Modify Tools Via Taskkill
id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0
version: 15
creation_date: '2023-09-19'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of taskkill.exe to forcibly terminate processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific taskkill parameters. This activity is significant because it can indicate attempts to disable security tools or disrupt legitimate applications, a common tactic in malware operations. If confirmed malicious, this behavior could allow attackers to evade detection, disrupt system stability, and potentially gain further control over the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_disable_or_modify_tools_via_taskkill_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Network administrator can use this application to kill process during audit or investigation.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A taskkill process to terminate process is executed on host- $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - PXA Stealer
    - NjRAT
    - Crypto Stealer
    - BlankGrabber Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows ESX Admins Group Creation via PowerShell
id: f48a5557-be06-4b96-b8e8-be563e387620
version: 10
creation_date: '2024-07-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects attempts to create an "ESX Admins" group using PowerShell commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText="*New-ADGroup*" OR ScriptBlockText="*New-LocalGroup*") ScriptBlockText="*ESX Admins*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_esx_admins_group_creation_via_powershell_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. You can find additional setup instructions in the Splunk documentation for configuring PowerShell logging.
known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities.
references:
    - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505
    - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
    - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
finding:
    title: PowerShell command to create "ESX Admins" group detected on host $dest$ by user $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: PowerShell command to create "ESX Admins" group detected on host $dest$ by user $user_id$.
analytic_story:
    - VMware ESXi AD Integration Authentication Bypass CVE-2024-37085
asset_type: Endpoint
mitre_attack_id:
    - T1136.002
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Tamper Protection
id: 12094335-88fc-4c3a-b55f-e62dd8c93c23
version: 12
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious modification to the Windows Defender Tamper Protection registry setting. It leverages data from the Endpoint datamodel, specifically targeting changes where the registry path is set to disable Tamper Protection. This activity is significant because disabling Tamper Protection can allow adversaries to make further undetected changes to Windows Defender settings, potentially leading to reduced security on the system. If confirmed malicious, this could enable attackers to evade detection, persist in the environment, and execute further malicious activities without interference from Windows Defender.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_tamper_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
finding:
    title: A registry modification to tamper Windows Defender protection on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Scattered Lapsus$ Hunters
    - RedLine Stealer
asset_type: Endpoint
atomic_guid:
    - 12e03af7-79f9-4f95-af48-d3f12f28a260
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Processes Killed By Industroyer2 Malware
id: d8bea5ca-9d4a-4249-8b56-64a619109835
version: 10
creation_date: '2022-04-28'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the termination of specific processes by the Industroyer2 malware. It leverages Sysmon EventCode 5 to identify when processes like "PServiceControl.exe" and "PService_PPD.exe" are killed. This activity is significant as it targets processes related to energy facility networks, indicating a potential attack on critical infrastructure. If confirmed malicious, this could lead to disruption of essential services, loss of control over energy systems, and significant operational impact. Immediate investigation is required to determine the cause and mitigate any potential threats.
data_source:
    - Sysmon EventID 5
search: |-
    `sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe")
      | stats min(_time) as firstTime max(_time) as lastTime count
        BY dest process process_exec
           process_guid process_id process_name
           process_path signature signature_id
           user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_processes_killed_by_industroyer2_malware_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
known_false_positives: False positives are possible if legitimate applications are allowed to terminate this process during testing or updates. Filter as needed based on paths that are used legitimately.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: process was terminated $process_name$ on $dest$
analytic_story:
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint