Splunk rules: 24

name: ASL AWS Network Access Control List Created with All Open Ports
id: a2625034-c2de-44fc-b45c-7bac9c4a7974
version: 9
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=CreateNetworkAclEntry OR api.operation=ReplaceNetworkAclEntry status=Success
      | spath input=api.request.data path=ruleAction output=ruleAction
      | spath input=api.request.data path=egress output=egress
      | spath input=api.request.data path=aclProtocol output=aclProtocol
      | spath input=api.request.data path=cidrBlock output=cidrBlock
      | spath input=api.request.data path=networkAclId output=networkAclId
      | search ruleAction=allow AND egress=false AND aclProtocol=-1 AND cidrBlock=0.0.0.0/0
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region networkAclId
           cidrBlock
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_network_access_control_list_created_with_all_open_ports_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
references: []
finding:
    title: User $user$ has created network ACLs with all the ports opens to $cidrBlock$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Network ACL Activity
asset_type: AWS Instance
mitre_attack_id:
    - T1686.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Azure Active Directory High Risk Sign-in
id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
version: 14
creation_date: '2022-07-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects high-risk sign-in attempts against Azure Active Directory, identified by Azure Identity Protection. It leverages the RiskyUsers and UserRiskEvents log categories from Azure AD events ingested via EventHub. This activity is significant as it indicates potentially compromised accounts, flagged by heuristics and machine learning. If confirmed malicious, attackers could gain unauthorized access to sensitive resources, leading to data breaches or further exploitation within the environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=UserRiskEvents properties.riskLevel=high
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product category
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_active_directory_high_risk_sign_in_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category in the azure:monitor:aad sourcetype.
known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
    - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks
finding:
    title: A high risk event was identified by Identify Protection for user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1110.003
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure AD Multiple Service Principals Created by User
id: 32880707-f512-414e-bd7f-204c0c85b758
version: 12
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute timeframe in Azure AD. It detects this activity by monitoring the 'Add service principal' operation and aggregating data in 10-minute intervals. This behavior is significant as it may indicate an adversary rapidly creating multiple service principals to stage an attack or expand their foothold within the network. If confirmed malicious, this activity could allow attackers to establish persistence, escalate privileges, or access sensitive information within the Azure environment.
data_source:
    - Azure Active Directory Add service principal
search: |-
    `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.user.id=*
      | rename properties.* as *
      | bucket span=10m _time
      | rename targetResources{}.displayName as displayName
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime dc(displayName) as unique_apps values(displayName) as displayName values(dest) as dest values(src) as src values(user) as user values(user_agent) as user_agent
        BY src_user vendor_account vendor_product
           signature
      | where unique_apps > 3
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multiple_service_principals_created_by_user_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple OAuth applications were created by $src_user$ in a short period of time
analytic_story:
    - Azure Active Directory Persistence
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '38494.69236'
title: Certificate Abuse - Windows
description: Threat actors may use tools such as Certipy or Certify.exe to enumerate
  misconfigurations in certificate services, allowing them to gather information on
  potential vulnerabilities that could be exploited for privilege escalation or lateral
  movement within a network. This use case identifies potential abuse of Active Directory
  Certificate Services by monitoring Certificate Services events (4886 and 4887) or
  process creation events (event ID 4688) involving tools commonly used to exploit
  vulnerable configurations in AD CS such as certify.exe, accounting for instances
  where the binary has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4886) OR
  "<EventID>4886<" OR TERM(EventCode=4887) OR "<EventID>4887<") OR ((TERM(EventCode=4688)
  OR "<EventID>4688<" OR Type=Process) ("certify.exe" OR "request " OR "/ca:" OR "/template:"
  OR "/altname:")) | where match(signature_id, "4886|4887") or (match(signature_id,
  "4688") and match(process, "(?i)request\s.+/ca:.+/(template|altname):")) | table
  _time, host, user user, process, process_*, parent_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge authentication certificates
technique_id: 
- T1649
data_category:
- Windows event logs
references:
- https://github.com/ly4k/Certipy
- https://www.kali.org/tools/certipy-ad/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

name: Detect Renamed PSExec
id: 683e6196-b8e8-11eb-9a79-acde48001122
version: 17
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk, Alex Oberkircher, Github Community
status: production
type: Hunting
description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name!=psexec.exe
            AND
            Processes.process_name!=psexec64.exe
        )
        AND Processes.original_file_name=psexec.c
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_renamed_psexec_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
    - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
analytic_story:
    - Active Directory Lateral Movement
    - BlackByte Ransomware
    - Cactus Ransomware
    - China-Nexus Threat Activity
    - CISA AA22-320A
    - DarkGate Malware
    - DarkSide Ransomware
    - DHS Report TA18-074A
    - HAFNIUM Group
    - Medusa Ransomware
    - Rhysida Ransomware
    - Salt Typhoon
    - SamSam Ransomware
    - Sandworm Tools
    - VanHelsing Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable Defender Submit Samples Consent Feature
id: 73922ff8-3022-11ec-bf5e-acde48001122
version: 16
creation_date: '2021-10-18'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry to disable the Windows Defender Submit Samples Consent feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet and the SubmitSamplesConsent value set to 0x00000000. This activity is significant as it indicates an attempt to bypass or evade detection by preventing Windows Defender from submitting samples for further analysis. If confirmed malicious, this could allow an attacker to execute malicious code without being detected by Windows Defender, leading to potential system compromise.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
      WHERE (
              Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" AND
              Registry.registry_value_name = SubmitSamplesConsent AND
              Registry.registry_value_data IN (0, 0x00000000)
             )
              by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
         | `drop_dm_object_name(Registry)`
         | where isnotnull(registry_value_data)
         | `security_content_ctime(firstTime)`
         | `security_content_ctime(lastTime)`
         | `disable_defender_submit_samples_consent_feature_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Azorult
    - CISA AA23-347A
    - IcedID
    - Windows Registry Abuse
    - BlankGrabber Stealer
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: HTTP C2 Framework User Agent
id: 229dc225-6abe-4d28-89fd-edf874086162
version: 5
creation_date: '2026-01-06'
modification_date: '2026-05-13'
author: Ravent Tait, Splunk
status: production
type: TTP
description: This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. This activity can signify malicious actors attempting to interact with hosts on the network using known default configurations of command and control tools.
data_source:
    - Suricata
search: |-
    | tstats  `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_user_agent != null
      BY Web.http_user_agent Web.http_method, Web.url,
         Web.url_length Web.src, Web.dest
    | `drop_dm_object_name("Web")`
    | lookup suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description
    | where isnotnull(tool)
    | stats count min(firstTime) as first_seen max(lastTime) as last_seen
      BY tool url http_user_agent
         src dest description
    | `security_content_ctime(first_seen)`
    | `security_content_ctime(last_seen)`
    | `http_c2_framework_user_agent_filter`
how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: Filtering may be required in some instances depending on legacy system usage, filter as needed.
references:
    - https://github.com/BC-SECURITY/Malleable-C2-Profiles
    - https://www.keysight.com/blogs/en/tech/nwvs/2021/07/28/koadic-c3-command-control-decoded
    - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
finding:
    title: A known C2 Framework user agent $http_user_agent$ was performing a request from $src$ to $dest$.
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: dest
      type: system
    - field: http_user_agent
      type: http_user_agent
analytic_story:
    - Cobalt Strike
    - Brute Ratel C4
    - Tuoni
    - Meterpreter
    - Spearphishing Attachments
    - Malicious PowerShell
    - BishopFox Sliver Adversary Emulation Framework
    - Suspicious User Agents
asset_type: Network
mitre_attack_id:
    - T1071.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Possible Append Command To Profile Config File
id: 9c94732a-61af-11ec-91e3-acde48001122
version: 12
creation_date: '2022-01-11'
modification_date: '2026-08-12'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile.
    This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts.
    If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process = "*echo*"
    (
        Processes.process IN ("*/home/*", "*~/*", "*/etc/*")
        Processes.process IN (
            "*/.bash_login*",
            "*/.bash_logout*",
            "*/.bash_profile*",
            "*/.bashrc*",
            "*/.profile*",
            "*/profile*"
        )
        OR
        (
            Processes.process_current_directory = "/home/*"
            Processes.process IN (
                "*.bash_login*",
                "*.bash_logout*",
                "*.bash_profile*",
                "*.bashrc*",
                "*.profile*",
                "* profile*"
            )
        )
    )

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process_current_directory Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_append_command_to_profile_config_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
    - https://attack.mitre.org/techniques/T1546/004/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The [$process_name$] process is attempting to modify Shell Profile files via the Command Line [$process$] on [$dest$]
threat_objects:
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft Intune Device Health Scripts
id: 6fe42e07-15b1-4caa-b547-7885666cb1bd
version: 4
creation_date: '2025-01-06'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: Hunting
description: >-
    Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices.
    This detection identifies when a new device health script has been added, updated or deleted.
data_source:
    - Azure Monitor Activity
search: >-
    `azure_monitor_activity` operationName="*DeviceHealthScript*"
    | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
    | rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" | replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action
    | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
    | `microsoft_intune_device_health_scripts_filter`
how_to_implement: >-
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
references:
    - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
    - https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
    - https://posts.specterops.io/maestro-9ed71d38d546
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1072
    - T1021.007
    - T1202
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

id: '28417.51669'
title: MultiDump.exe Execution
description: MultiDump is a post-exploitation tool written in C with a Python handler
  designed to discreetly dump and extract LSASS memory without triggering Defender
  alerts. This use case detects rundll32 executions with specific command line parameters
  unique to MultiDump.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "rundll32" "OpenOptimizationControlPanel" "cleanup"
  "defrag" "optimize:startup" "report" ".dmp" | table _time, host, user, process,
  process_*, parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.002
- T1003
- T1003.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://xre0us.io/posts/multidump/
- https://github.com/Xre0uS/MultiDump?tab=readme-ov-file

id: '5525.5749'
title: Native Archive Commands
description: 'An adversary may compress and/or encrypt data that is collected prior
  to exfiltration. Compressing the data can help to obfuscate the collected data and
  minimize the amount of data sent over the network. - Threat Actor Association: APT28
  (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, Conti, DarkSide, BlackMatter, FIN7, Karakurt, MuddyWater,
  TA428, Volt Typhoon, Witchetty - Software Association: Black Basta, NanoCore, Ransom
  Cartel, SquirrelWaffle - Atomics T1074.001 Test#3 Atomics T1560 Test#1 Atomics T1560.001
  Test #5 Atomics T1560.001 Test #6 Atomics T1560.001 Test #7 Atomics T1560.001 Test
  #8 Atomics T1560.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(Compress-Archive)
  OR TERM(tar) OR TERM(makecab) OR TERM(compact.exe) OR TERM(compact) OR (TERM(Compression)
  TERM(System) TERM(IO))) | regex process!="(Decompress)" | regex process="(?i)Compress-Archive|tar|makecab|compact|System\.IO\.Compression"
  | table _time, host, user signature_id, process, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- collection:archive collected data
technique_id:
- T1074.001
- T1560
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

id: '33164.58810'
title: Suspicious ComputerDefaults.exe Execution
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects high or system
  integrity-level executions of ComputerDefaults.exe that are not initiated from Windows\System32
  or Program Files directories. Atomics T1548.002 Test #5 Living Off the Land Binary
  and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TokenElevationType="%%1937" "ComputerDefaults.exe"
  | regex parent_process_path!="(?i):\x5c(Windows\x5cSystem32|Program\sFiles)"| regex
  process_path="(?i):\x5cWindows\x5cSystem32\x5cComputerDefaults\.exe" | table _time,
  host, user ObjectName, process, process_*, parent_process_name | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml

id: '5856.6154'
title: Suspicious File written to Disk
description: 'Adversaries may transfer tools or other files from an external system
  into a compromised environment. As seen with Solorigate when backdoor activates,
  the executing process (usually SolarWinds.BusinessLayerHost.exe) creates two files
  on disk. This use case looks for when dlls or vbs files added to Disk. -- Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT34/OilRig, APT41, FIN7, Gamaredon
  (aka. Armageddon, UAC-0010), Gorgon Group, Harvester, Lazarus, Night Spider, TA413,
  TA551, Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2465, Wizard Spider
  -- Software Association: ALPHV/BlackCat, Bazar, Black Basta, Clop, DirtyMoe, Dridex,
  Hive, IcedID, LOWZERO, PowerShortShell, Quantum, Qakbot/Qbot, RATDispenser, Remcos,
  Royal, Ryuk, SmokedHAM, Soul, VawTrak, Vidar Stealer, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<") (TERM(dll) OR TERM(vbs)) NOT DELETE| regex Object_Name="(?i)\.(dll|vbs)"
  | rename Object_Name as file_path | table _time, host, user, event_id, file_path,
  process_name, process_path, signature_id | bin span=60s | stats values(*) as * by
  _time, host | eventstats dc(file_path) as dc_file_path by process_name | where dc_file_path
  < 3 and event_count < 4 '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- File monitoring
- Windows event logs
references: null

name: Web JSP Request via URL
id: 2850c734-2d44-4431-8139-1a56f6f54c01
version: 11
creation_date: '2022-04-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. It detects HTTP GET requests with URLs containing ".jsp?cmd=" or "j&cmd=" patterns. This activity is significant as it indicates potential webshell deployment, which can lead to unauthorized remote command execution. If confirmed malicious, attackers could gain control over the webserver, execute arbitrary commands, and potentially escalate privileges, leading to severe data breaches and system compromise.
data_source:
    - Nginx Access
search: |-
    | tstats count FROM datamodel=Web
      WHERE Web.http_method IN ("GET") Web.url IN ("*.jsp?cmd=*","*j&cmd=*")
      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
         Web.src, Web.dest sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `web_jsp_request_via_url_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
references:
    - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
    - https://github.com/TheGejr/SpringShell
    - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
finding:
    title: A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Spring4Shell CVE-2022-22965
    - Earth Alux
asset_type: Web Server
cve:
    - CVE-2022-22965
mitre_attack_id:
    - T1133
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '8366.10476'
title: Windows External Remote Login
description: 'Detect when a remote logon connection is made from an external ip address.
  -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus, UNC3944), Volt
  Typhoon - Software Association: PYSA/Mespinoza'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "<EventID>4624<") Logon_Type=10 | search NOT src_ip IN (10.0.0.0/8, 127.0.0.0/8,
  169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
  "FE80::/10", "FF00::/8", "0.0.0.0") | iplocation src_ip| rename Country as country
  | table _time, host, user process, signature_id, src_ip, process_name, country |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- lateral-movement:remote services
technique_id:
- T1021.001
- T1021
data_category:
- Windows event logs
references:
- https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/

name: Windows Impair Defense Overide Win Defender Phishing Filter
id: 10ca081c-57b1-4a78-ba56-14a40a7e116a
version: 12
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable the Windows Defender phishing filter. It leverages data from the Endpoint.Registry data model, focusing on changes to specific registry values related to Microsoft Edge's phishing filter settings. This activity is significant because disabling the phishing filter can allow attackers to deceive users into visiting malicious websites without triggering browser warnings. If confirmed malicious, this could lead to users unknowingly accessing harmful sites, resulting in potential security incidents or data compromises.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path = "*\\MicrosoftEdge\\PhishingFilter*" Registry.registry_value_name IN ("EnabledV9", "PreventOverride") Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_overide_win_defender_phishing_filter_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender Phishing Filter registry was modified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process Executed From Removable Media
id: b483804a-4cc0-49a4-9f00-ac29ba844d08
version: 10
creation_date: '2025-01-17'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_current_directory=*
        AND
        NOT Processes.process_current_directory IN ("C:\\*","*\\sysvol\\*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product Processes.process_current_directory
    | `drop_dm_object_name(Processes)`
    | rex field=process_current_directory "^(?<object_handle>[^\\\]+\\\)"
    | where isnotnull(object_handle)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | join dest,object_handle
    [
    | tstats `security_content_summariesonly` count values(Registry.action) as action values(Registry.process_guid) as process_guid values(Registry.process_id) as process_id values(Registry.registry_hive) as registry_hive values(Registry.registry_key_name) as registry_key_name values(Registry.registry_value_name) as registry_value_name values(Registry.registry_value_type) as registry_value_type values(Registry.status) as status values(Registry.user) as user values(Registry.vendor_product) as vendor_product FROM datamodel=Endpoint.Registry
      WHERE Registry.registry_value_data="*:\\*"
        AND
        Registry.registry_path="*USBSTOR*"
        AND
        Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")
      BY Registry.dest,Registry.registry_value_data, Registry.registry_path
    | `drop_dm_object_name(Registry)`
    | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&amp;"),2),"PROD_","")
        ]
    | `windows_process_executed_from_removable_media_filter`
how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process Execution commands. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. This analytic joins the Process and Registry datamodels together based on the drive letter extract to the "object_handle" field from both datasets.
known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
references:
    - https://attack.mitre.org/techniques/T1200/
    - https://www.cisa.gov/news-events/news/using-caution-usb-drives
    - https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The process [$process_name$] was launched using files on a removable storage device named [$object_name$] by [$user$] on $dest$
        - field: dest
          type: system
          score: 20
          message: The process [$process_name$] was launched using files on a removable storage device named [$object_name$] by [$user$] on $dest$
threat_objects:
    - field: object_handle
      type: registry_value_text
    - field: object_name
      type: registry_value_name
    - field: process_name
      type: process_name
analytic_story:
    - Data Protection
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1200
    - T1025
    - T1091
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Steal Authentication Certificates Certificate Issued
id: 9b1a5385-0c31-4c39-9753-dc26b8ce64c2
version: 9
creation_date: '2023-02-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the issuance of a new certificate by Certificate Services - AD CS, detected via Event ID 4887. This event logs the requester user context, DNS hostname of the requesting machine, and the request time. Monitoring this activity is crucial as it can indicate potential misuse of authentication certificates. If confirmed malicious, an attacker could use the issued certificate to impersonate users, escalate privileges, or maintain persistence within the environment. This detection helps in identifying and correlating suspicious certificate-related activities for further investigation.
data_source:
    - Windows Event Log Security 4887
search: |-
    `wineventlog_security`  EventCode=4887
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, name, Requester,
           action, Attributes, Subject
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_steal_authentication_certificates_certificate_issued_filter`
how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference.
known_false_positives: False positives will be generated based on normal certificates issued. Leave enabled to generate Risk, as this is meant to be an anomaly analytic.
references:
    - https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A certificate was issued to $dest$.
analytic_story:
    - Windows Certificate Services
asset_type: Endpoint
mitre_attack_id:
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint