Splunk rules: 25

name: ASL AWS Concurrent Sessions From Different Ips
id: b3424bbe-3204-4469-887b-ec144483a336
version: 13
creation_date: '2023-02-01'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute span. This detection leverages AWS CloudTrail logs, specifically the `DescribeEventAggregates` API call, to identify multiple IP addresses associated with the same user session. This behavior is significant as it may indicate a session hijacking attack, where an adversary uses stolen session cookies to access AWS resources from a different location. If confirmed malicious, this activity could allow unauthorized access to sensitive corporate resources, leading to potential data breaches or further exploitation.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=DescribeEventAggregates src_endpoint.domain!="AWS Internal"
      | bin span=5m _time
      | stats min(_time) as firstTime max(_time) as lastTime values(api.operation) as api.operation values(api.service.name) as api.service.name values(http_request.user_agent) as http_request.user_agent values(src_endpoint.ip) as src_ip values(actor.user.account.uid) as actor.user.account.uid values(cloud.provider) as cloud.provider values(cloud.region) as cloud.region dc(src_endpoint.ip) as distinct_ip_count
        BY _time actor.user.uid
      | where distinct_ip_count > 1
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_concurrent_sessions_from_different_ips_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
references:
    - https://attack.mitre.org/techniques/T1185/
    - https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
    - https://github.com/kgretzky/evilginx2
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ has concurrent sessions from more than one unique IP address in the span of 5 minutes.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Compromised User Account
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD Multi-Source Failed Authentications Spike
id: 116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
version: 12
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and countries, using different user agents. This detection leverages Azure AD SignInLogs, focusing on error code 50126 for failed authentications. This activity is significant as it indicates an adversary's attempt to bypass security controls by distributing login attempts. If confirmed malicious, this could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization's infrastructure.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=*SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
      | rename properties.* as *
      | bucket span=5m _time
      | eval uniqueIPUserCombo = src_ip . "-" . user
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, dc(user_agent) as uniqueUserAgents, dc(location.countryOrRegion) as uniqueCountries values(location.countryOrRegion) as countries  values(action) as action values(dest) as dest values(user) as user values(src) as src values(vendor_account) as vendor_account values(vendor_product) as vendor_product values(user_agent) as user_agent
      | where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20 AND uniqueUserAgents >= 1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multi_source_failed_authentications_spike_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: This detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of VPNs or cloud services that rotate IP addresses. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
analytic_story:
    - Azure Active Directory Account Takeover
    - NOBELIUM Group
asset_type: Azure Tenant
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '5327.5689'
title: Certutil File Download
description: 'There are attack scenarios in which attackers download different tools
  or scripts in order to take full control over certain machines. For example, an
  attacker gets a reverse shell on the target but is a low privileged shell. In this
  situation, the attacker can download different exploits on the target for privilege
  escalation using tools such as wget. -- Threat Actor Association: APT41, DarkSide,
  BlackMatter, APT31, Flax Typhoon, Wizard Spider - Software Association: ALPHV/BlackCat,
  Babuk, Bazar, Conti -- Atomics T1027 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 TERM("certutil")
  | where match (process, "(?i)(\w?\wtps?\:(\/\/|\x5c\x5c))|\:\/\/") OR (match(process_name,
  "(?i)certutil") AND match(process, "(?i)u.*?r.*?l.*?c.*?a.*?c.*?h.*?e")) | table
  _time, host, user, signature_id, process, process_*, parent_process, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host, process '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:obfuscated files or information
technique_id: 
- T1105
- T1027
data_category:
- Windows Sysmon
references:
- https://www.ired.team/offensive-security/defense-evasion/downloading-file-with-certutil

name: Clop Ransomware Known Service Name
id: 07e08a12-870c-11eb-b5f9-acde48001122
version: 12
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras
status: production
type: TTP
description: The following analytic identifies the creation of a service with a known name used by CLOP ransomware for persistence and high-privilege code execution. It detects this activity by monitoring Windows Event Logs (EventCode 7045) for specific service names ("SecurityCenterIBM", "WinCheckDRVs"). This activity is significant because the creation of such services is a common tactic used by ransomware to maintain control over infected systems. If confirmed malicious, this could allow attackers to execute code with elevated privileges, maintain persistence, and potentially disrupt or encrypt critical data.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system` EventCode=7045 ServiceName IN ("SecurityCenterIBM", "WinCheckDRVs")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer EventCode ServiceName
           StartType ServiceType
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `clop_ransomware_known_service_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
finding:
    title: An instance of a known Clop Ransomware Service Name detected on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Compromised Windows Host
    - Clop Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect DNS Query to Decommissioned S3 Bucket
id: 2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e
version: 6
creation_date: '2025-02-12'
modification_date: '2026-05-13'
author: Jose Hernandez, Splunk
status: experimental
type: Anomaly
description: This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. This activity is significant because attackers may attempt to recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
data_source:
    - Sysmon EventID 22
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
      WHERE DNS.message_type=QUERY
      BY DNS.answer DNS.answer_count DNS.query
         DNS.query_count DNS.reply_code_id DNS.src
         DNS.vendor_product
    | `drop_dm_object_name("DNS")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | eval bucket_domain = lower(query)
    | lookup decommissioned_buckets bucketName as bucket_domain OUTPUT bucketName as match
    | where isnotnull(match)
    | `detect_dns_query_to_decommissioned_s3_bucket_filter`
how_to_implement: To successfully implement this detection, you need to be ingesting DNS query logs and have them mapped to the Network_Resolution data model. Additionally, ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is running and populating the decommissioned_buckets KVstore lookup.
known_false_positives: Some applications or scripts may continue to reference old S3 bucket names after they have been decommissioned. These should be investigated and updated to prevent potential security risks.
references:
    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
    - https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A DNS query to decommissioned S3 bucket $query$ was detected from host $src$
threat_objects:
    - field: query
      type: domain
analytic_story:
    - AWS S3 Bucket Security Monitoring
    - Data Destruction
asset_type: Network
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
baselines:
    - Baseline Of Open S3 Bucket Decommissioning

id: '16818.27143'
title: File and Directory Discovery Output to File - Windows
description: 'Adversaries may enumerate files and directories or may search in specific
  locations of a host or network share for certain information within a file system.
  Adversaries may use the information from File and Directory Discovery during automated
  discovery to shape follow-on behaviors, including whether or not the adversary fully
  infects the target and/or attempts specific actions. -- Threat Actor Association:
  APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team) -- Atomics T1083
  Test #1 Atomics T1083 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(tree) OR TERM(dir)
  OR TERM(Get-ChildItem) OR TERM(gci) OR TERM(ls) OR TERM(locate) OR TERM(find)) (TERM(>>)
  OR "&gt;&gt;" OR TERM(Out-File)) | table _time, host, user process, process_*, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md#atomic-test-1---file-and-directory-discovery-cmdexe

name: Gsuite Email Suspicious Subject With Attachment
id: 8ef3971e-00f2-11ec-b54f-acde48001122
version: 10
creation_date: '2021-08-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. It leverages Gsuite email logs, focusing on specific keywords in the subject line and known malicious file types in attachments. This activity is significant for a SOC as spear phishing is a prevalent method for initial compromise, often leading to further malicious actions. If confirmed malicious, this activity could result in unauthorized access, data exfiltration, or further malware deployment, posing a significant risk to the organization's security.
data_source:
    - G Suite Gmail
search: |-
    `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
      | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
      | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
      | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="medium"
      | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
        BY destination{}.service num_message_attachments subject
           destination{}.address source.address phase
           severity
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_email_suspicious_subject_with_attachment_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
    - https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks
intermediate_findings:
    entities:
        - field: destination{}.address
          type: user
          score: 20
          message: Suspicious email from $source.address$ to $destination{}.address$
threat_objects:
    - field: source.address
      type: email_address
analytic_story:
    - Dev Sec Ops
asset_type: GSuite
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Kubernetes newly seen TCP edge
id: 13f081d6-7052-428a-bbb0-892c79ca7c65
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies newly seen TCP communication between source and destination workload pairs within a Kubernetes cluster. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to spot new inter-workload communications. This is significant as new connections can indicate changes in application behavior or potential security threats. If malicious, unauthorized connections could lead to data breaches, privilege escalation, lateral movement, or disruption of critical services, compromising the application's integrity, availability, and confidentiality.
data_source: []
search: |-
    | mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics` AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name
    | eval current="True"
    | append [ mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics` AND earliest=-30d latest=-1h by source.workload.name dest.workload.name
    | eval current="false" ]
    | eventstats values(current) as current
      BY source.workload.name dest.workload.name
    | search current="true" current!="false"
    | rename k8s.cluster.name as host
    | `kubernetes_newly_seen_tcp_edge_filter`
how_to_implement: "To gather NPM metrics the Open Telemetry to the Kubernetes Cluster and enable Network Performance Monitoring according to instructions found in Splunk Docs https://help.splunk.com/en/splunk-observability-cloud/monitor-infrastructure/network-explorer/set-up-network-explorer-in-kubernetes#network-explorer-setup In order to access those metrics from within Splunk Enterprise and ES, the Splunk Infrastructure Monitoring add-on must be installed and configured on a Splunk Search Head.  Once installed, first configure the add-on with your O11y Cloud Org ID and Access Token. Lastly set up the add-on to ingest metrics from O11y cloud using the following settings, and any other settings left at default:\n* Name sim_npm_metrics_to_metrics_index\n * Metric Resolution 10000"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes newly seen TCP edge in kubernetes cluster $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Add Files In Known Crontab Directories
id: 023f3452-5f27-11ec-bf00-acde48001122
version: 12
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized file creation in known crontab directories on Unix-based systems. It leverages filesystem data to identify new files in directories such as /etc/cron* and /var/spool/cron/*. This activity is significant as it may indicate an attempt by threat actors or malware to establish persistence on a compromised host. If confirmed malicious, this could allow attackers to execute arbitrary code at scheduled intervals, potentially leading to further system compromise and unauthorized access to sensitive information.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*/etc/cron*", "*/var/spool/cron/*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_add_files_in_known_crontab_directories_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can create file in crontab folders for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/
    - https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - XorDDos
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Scheduled Tasks
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Cpulimit Privilege Escalation
id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the 'cpulimit' command with specific flags ('-l', '-f') executed with 'sudo' privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and execution details. This activity is significant because if 'cpulimit' is granted sudo rights, a user can potentially execute system commands as root, leading to privilege escalation. If confirmed malicious, this could allow an attacker to gain root access, execute arbitrary commands, and fully compromise the affected system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*cpulimit*"
        AND
        Processes.process="*-l*"
        AND
        Processes.process="*-f*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_cpulimit_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/cpulimit/
    - http://cpulimit.sourceforge.net/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Cronjob Modification With Editor
id: dcc89bde-5f24-11ec-87ca-acde48001122
version: 10
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects potential unauthorized modifications to Linux cronjobs using text editors like "nano," "vi," or "vim." It identifies this activity by monitoring command-line executions that interact with cronjob configuration paths. This behavior is significant for a SOC as it may indicate attempts at privilege escalation or establishing persistent access. If confirmed malicious, the impact could be severe, allowing attackers to execute damaging actions such as data theft, system sabotage, or further network penetration.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name IN("nano","vim.basic")
            OR
            Processes.process IN ("*nano *", "*vi *", "*vim *")
        )
        AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_cronjob_modification_with_editor_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1053/003/
analytic_story:
    - XorDDos
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Scheduled Tasks
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8513.10739'
title: List Open Egress Ports
description: 'Each port allowed outbound from a network creates an additional exit
  point for attackers to utilize. This use case looks for outbound port scans of the
  top 128 ports in use on the Internet as defined by the Nmap project. -- Software
  Association: IcedID, Nokoyawa -- Atomics T1016 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) OR "EventID>3<")
  dest_port IN(80,23,443,21,22,25,3389,110,445,139,143,53,135,3306,8080,1723,111,995,993,5900,1025,587,8888,199,1720,465,548,113,81,6001,10000,514,5060,179,1026,2000,8443,8000,32768,554,26,1433,49152,2001,515,8008,49154,1027,5666,646,5000,5631,631,49153,8081,2049,88,79,5800,106,2121,1110,49155,6000,513,990,5357,427,49156,543,544,5101,144,7,389,8009,3128,444,9999,5009,7070,5190,3000,5432,3986,13,1029,9,6646,49157,1028,873,1755,2717,4899,9100,119,37,1000,3001,5001,82,10010,1030,9090,2107,1024,2103,6004,1801,19,8031,1041,255,3703,17,808,3689,1031,1071,5901,9102,9000,2105,636,1038,2601,7000)
  NOT dest_ip IN(10.0.0.0/8, 172.16.0.0/12, 192.168.16.0/16, 127.0.0.0/8, ::1) | table
  _time, host, user, signature_id, process, process_*, parent_process_*, src_ip, dest_ip,
  dest_port `group_events("host, process_path", 10)`| eventstats dc(dest_port) as
  dc_dest_port by host, src_ip, _time| where dc_dest_port > 5 and event_count > 5 '
techniques:
- discovery:system network connections discovery
- discovery:network service discovery
technique_id: 
- T1049
- T1046
data_category:
- Windows Sysmon
- Process use of network
references:
- https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

id: '35191.61837'
title: MSI Installation via Appcert
description: An MSI file is a Microsoft Installer package used for installing software
  on Windows systems. Typically, .msi files are installed by msiexec.exe; AppCert.exe
  is a component of the Windows Application Compatibility Toolkit used primarily for
  application compatibility testing and can be used to install MSI files, but this
  is not normal usage for appcert. Threat actors may use appcert to install malicious
  MSI files in an attempt to evade detection. This use case detects appcert executions
  with commands to install an msi file. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process)(TERM(appcert) OR "appcert.exe") TERM(test) "-setupcommandline"
  | regex process="(?i)\stest\s.+\-setupcommandline" | table _time, host, user, process,
  parent_*, process_*, proxy_exec | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

name: O365 Service Principal Privilege Escalation
id: b686d0bd-cca7-44ca-ae07-87f6465131d9
version: 9
creation_date: '2025-01-05'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment.
data_source:
    - O365 Add app role assignment grant to user.
search: >-
    `o365_management_activity` Operation="Add app role assignment to service principal." "Actor{}.ID"=ServicePrincipal ResultStatus=Success
    | spath path=ModifiedProperties{} output=targetResources
    | eval src="NA"
    | stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(object) as targetAppContext values(user_agent) as user_agent values(user) as servicePrincipal values(UserId) as servicePrincipalId by Operation InterSystemsId tenant_id user dest src vendor_account vendor_product signature
    | spath input=appRole path=NewValue output=appRole
    | spath input=targetServicePrincipal path=NewValue output=targetServicePrincipal
    | where servicePrincipal=targetServicePrincipal
    | fillnull
    | stats earliest(_time) as firstTime latest(_time) as lastTime by servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenant_id InterSystemsId user dest src vendor_account vendor_product signature
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_service_principal_privilege_escalation_filter`
how_to_implement: The Splunk Add-on for Microsoft Office 365 add-on is required to ingest EntraID audit logs via the 365 API. See references for links for further details on how to onboard this log source.
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/4055
    - https://github.com/mvelazc0/BadZure
    - https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-navigating-the-shadows-of-midnight-blizzard.html
    - https://posts.specterops.io/microsoft-breach-what-happened-what-should-azure-admins-do-da2b7e674ebc
finding:
    title: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
    entity:
        field: servicePrincipal
        type: user
        score: 50
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Office 365 Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '15702.23323'
title: Removable Media Detected
description: 'Adversaries may move onto systems, possibly those on disconnected or
  air-gapped networks, by copying malware to removable media and taking advantage
  of Autorun features when the media is inserted into a system and executes. In the
  case of Lateral Movement, this may occur through modification of executable files
  stored on removable media or by copying malware and renaming it to look like a legitimate
  file to trick users into executing it on a separate system. In the case of Initial
  Access, this may occur through manual manipulation of the media, modification of
  systems used to initially format the media, or modification to the media''s firmware
  itself. - Threat Actor Association: APT28, APT29, Camaro Dragon, FIN7, Gamaredon
  Group/Shuckworm, UNC4990 - Software Association: Raspberry Robin'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=6416) OR "<EventID>6416<"
  | rex field=_raw "''DeviceDescription''?>(?<device_description>[^<]+)"| table _time,
  host, user, signature_id, process, process_*, parent_process_*, device_description
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- collection:data from removable media
- lateral-movement:replication through removable media
technique_id: 
- T1025
- T1091
data_category:
- Windows event logs
references:
- https://threatpost.com/fin7-mailing-malicious-usb-sticks-ransomware/177541/

name: SearchProtocolHost with no Command Line with Network
id: b690df8c-a145-11eb-a38b-acde48001122
version: 15
creation_date: '2021-04-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects instances of searchprotocolhost.exe running without command line arguments but with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because searchprotocolhost.exe typically runs with specific command line arguments, and deviations from this norm can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to establish network connections for command and control, potentially leading to data exfiltration or further system compromise.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where
    (
      Processes.process_name=searchprotocolhost.exe
      OR
      Processes.original_file_name=searchprotocolhost.exe
    )
    Processes.process IN (
      "*searchprotocolhost",
      "*searchprotocolhost.exe",
      "*searchprotocolhost.exe\""
    )
    by _time span=1h Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | join process_id dest
    [
      | tstats `security_content_summariesonly` count
        FROM datamodel=Network_Traffic.All_Traffic where
        All_Traffic.dest_port != 0
        by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
           All_Traffic.dest  All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
           All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
           All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
           All_Traffic.process_id
    | `drop_dm_object_name(All_Traffic)`
    | rename dest as C2
    | rename src as dest
    ]
    | table _time dest parent_process_name process_name process_path process process_id dest_port C2
    | `searchprotocolhost_with_no_command_line_with_network_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives may be present in small environments. Tuning may be required based on parent process.
references:
    - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
finding:
    title: A searchprotocolhost.exe process $process_name$ with no commandline on host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Graceful Wipe Out Attack
    - Cobalt Strike
    - Compromised Windows Host
    - BlackByte Ransomware
    - Cactus Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Linux Discovery Commands
id: 0edd5112-56c9-11ec-b990-acde48001122
version: 11
creation_date: '2022-02-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the execution of suspicious bash commands commonly used in scripts like AutoSUID, LinEnum, and LinPeas for system discovery on a Linux host. It leverages Endpoint Detection and Response (EDR) data, specifically looking for a high number of distinct commands executed within a short time frame. This activity is significant as it often precedes privilege escalation or other malicious actions. If confirmed malicious, an attacker could gain detailed system information, identify vulnerabilities, and potentially escalate privileges, posing a severe threat to the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names FROM datamodel=Endpoint.Processes
      WHERE [
    | inputlookup linux_tool_discovery_process
    | rename process as Processes.process
    | table Processes.process] by _time span=5m Processes.user Processes.dest
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where distinct_commands > 40 AND distinct_process_names > 3
    | `suspicious_linux_discovery_commands_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored.
references:
    - https://attack.mitre.org/matrices/enterprise/linux/
    - https://attack.mitre.org/techniques/T1059/004/
    - https://github.com/IvanGlinkin/AutoSUID
    - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
    - https://github.com/rebootuser/LinEnum
finding:
    title: Suspicious Linux Discovery Commands detected on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Post-Exploitation
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious msbuild path
id: f5198224-551c-11eb-ae93-0242ac130002
version: 14
creation_date: '2021-01-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of msbuild.exe from a non-standard path. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that deviate from typical msbuild.exe locations. This activity is significant because msbuild.exe is commonly abused by attackers to execute malicious code, and running it from an unusual path can indicate an attempt to evade detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise and further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
finding:
    title: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
analytic_story:
    - Trusted Developer Utilities Proxy Execution MSBuild
    - Masquerading - Rename System Utilities
    - Living Off The Land
    - Cobalt Strike
    - BlackByte Ransomware
    - Graceful Wipe Out Attack
    - Storm-2460 CLFS Zero Day Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
    - T1127.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Defender ASR Block Events
id: 026f5f4e-e99f-4155-9e63-911ba587300b
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.
data_source:
    - Windows Event Log Defender 1121
    - Windows Event Log Defender 1126
    - Windows Event Log Defender 1129
    - Windows Event Log Defender 1131
    - Windows Event Log Defender 1133
search: |-
    `ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133)
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY host, Path, Parent_Commandline,
           Process_Name, ID, EventCode
      | lookup asr_rules ID OUTPUT ASR_Rule
      | fillnull value=NULL
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | rename host as dest
      | `windows_defender_asr_block_events_filter`
how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event.
known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is block only.
references:
    - https://asrgen.streamlit.app/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: ASR block event, $ASR_Rule$, was triggered on $dest$.
analytic_story:
    - Windows Attack Surface Reduction
asset_type: Endpoint
mitre_attack_id:
    - T1059
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint