Splunk rules: 26

name: Azure AD New Federated Domain Added
id: a87cd633-076d-4ab2-9047-977751a3c1a0
version: 15
creation_date: '2022-09-02'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It leverages Azure AD AuditLogs to identify successful "Set domain authentication" operations. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.
data_source:
    - Azure Active Directory Set domain authentication
search: |-
    `azure_monitor_aad` operationName="Set domain authentication" "properties.result"=success
      | rename properties.* as *
      | rename targetResources{}.displayName as domain
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           domain signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_new_federated_domain_added_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: In most organizations, domain federation settings will be updated infrequently. Filter as needed.
references:
    - https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
    - https://o365blog.com/post/federation-vulnerability/
    - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
    - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
    - https://attack.mitre.org/techniques/T1484/002/
finding:
    title: A new federated domain, $domain$ , was added by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
    - Scattered Lapsus$ Hunters
    - Hellcat Ransomware
    - Storm-0501 Ransomware
asset_type: Azure Active Directory
mitre_attack_id:
    - T1484.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Check Elevated CMD using whoami
id: a9079b18-1633-11ec-859c-acde48001122
version: 11
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". This string represents the SID of the group "Mandatory Label\High Mandatory Level" effectively checking if the current process is running as a "High" integrity process or with Administrator privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because it is commonly used by attackers, such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious, this behavior could indicate an attacker is assessing their privilege level, potentially leading to further privilege escalation or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process = "*12288*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `check_elevated_cmd_using_whoami_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated.
references: []
finding:
    title: Process name $process_name$ with commandline $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Process name $process_name$ with commandline $process$ on $dest$
analytic_story:
    - FIN7
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Secure Firewall - Malware File Downloaded
id: 3cc93f52-5aa6-4b7f-83b9-3430b1436813
version: 8
creation_date: '2025-04-09'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the `SHA_Disposition` field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.
data_source:
    - Cisco Secure Firewall Threat Defense File Event
search: |
    `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download"
    | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(uri) as uri
            values(ClientApplication) as ClientApplication
            values(file_hash) as file_hash
            by FileDirection dest src dest_port FileType app file_name ThreatName Description
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
    | `cisco_secure_firewall___malware_file_downloaded_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: Malicious verdicts could be outdated or incorrect due to retroactive threat intel.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: File with Malware disposition downloaded from $dest$ over port $dest_port$ by $src$
threat_objects:
    - field: file_hash
      type: file_hash
    - field: file_name
      type: file_name
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1203
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

id: '13810.20277'
title: Cmstp Execution
description: 'Adversaries may abuse CMSTP to proxy execution of malicious code. The
  Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program
  used to install Connection Manager service profiles. CMSTP.exe accepts an installation
  information file (INF) as a parameter and installs a service profile leveraged for
  remote access connections. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  Atomics T1218.003 Test #1 Atomics T1218.003 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cmstp.exe") OR ("/s" "/.inf") OR "/ni" OR "/ns"
  | regex process="(?i)cmstp|\s+\/s\s+.+\.inf|\s+\/ni\s+.{4,}|\s+\/ns\s+.{4,}" | table
  _time, host, user process, process_*, signature_id, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:cmstp
technique_id:
- T1218.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Cmstp/

name: CSC Net On The Fly Compilation
id: ea73128a-43ab-11ec-9753-acde48001122
version: 10
creation_date: '2021-11-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the use of the .NET compiler csc.exe for on-the-fly compilation of potentially malicious .NET code. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with csc.exe. This activity is significant because adversaries and malware often use this technique to evade detection by compiling malicious code at runtime. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=csc.exe
            OR
            Processes.original_file_name=csc.exe
        )
        Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `csc_net_on_the_fly_compilation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated powershell script taht execute .net code that may generate false positive. filter is needed.
references:
    - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
    - https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1027.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Exchange Web Shell
id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
version: 16
creation_date: '2021-03-18'
modification_date: '2026-05-13'
author: Michael Haag, Shannon Davis, David Dorsey, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of suspicious .aspx files in known drop locations for Exchange exploitation, specifically targeting paths associated with HAFNIUM group and vulnerabilities like ProxyShell and ProxyNotShell. It leverages data from the Endpoint datamodel, focusing on process and filesystem events. This activity is significant as it may indicate a web shell deployment, a common method for persistent access and remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary commands, and potentially escalate privileges within the Exchange environment.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name IN( "*.aspx", "*.ashx") by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_exchange_web_shell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
references:
    - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
    - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
    - https://www.youtube.com/watch?v=FC6iHw258RI
    - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
finding:
    title: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - ProxyNotShell
    - CISA AA22-257A
    - HAFNIUM Group
    - ProxyShell
    - Compromised Windows Host
    - BlackByte Ransomware
    - Seashell Blizzard
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1133
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
id: 114c6bfe-9406-11ec-bcce-acde48001122
version: 15
creation_date: '2022-02-18'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-ADUser` PowerShell cmdlet with parameters indicating a search for domain accounts with Kerberos Pre-Authentication disabled. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific activity. This behavior is significant because discovering accounts with Kerberos Pre-Authentication disabled can allow adversaries to perform offline password cracking. If confirmed malicious, this activity could lead to unauthorized access to user accounts, potentially compromising sensitive information and escalating privileges within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
references:
    - https://attack.mitre.org/techniques/T1558/004/
    - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
    - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
finding:
    title: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - CISA AA23-347A
    - Active Directory Kerberos Attacks
    - BlackSuit Ransomware
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1040.1060'
title: Executable File Written to Disk
description: 'Detects when a potentially malicious file is written to the disk. -
  Threat Actor Association: Alloy Taurus/Gallium, Andariel, APT28 (aka.Fancy Bear,
  Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, APT34/OilRig, APT37, APT41, Arid Viper/APT C-23, Babuk, Carbanak, Evilnum,
  FIN6, FIN7, FIN8, Gamaredon (aka. Armageddon, UAC-0010), Kimsuky, Lazarus, MalKamak,
  Memento Team, Mustang Panda, Night Spider, TA2541, TA,505, TA551, Prophet Spider,
  Phosphorus/Magic Hound/APT35, SaintBear (aka UAC-0056, UNC2589, TA471), Scatter
  Swine, TA576, Wizard Spider -- Software Association: BadHatch, Bazar, Black Basta,
  BlackByte, Clop, Conti, Cring, Emotet, GhostShell, Hancitor, Harvester, IcedID,
  Lapsus$, MirrorBlast, PYSA/Mespinoza, QakBot, Ransom Cartel, Remcos, Ryuk, SquirrelWaffle,
  TargetCompany, Trickbot, Vidar Stealer, WhisperGate, XingLocker, Yanluowang, Zloader'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=11 (TERM("bat")
  OR TERM("bin") OR TERM("cmd") OR TERM("com") OR TERM("e_e") OR TERM("ex_") OR TERM("exe")
  OR TERM("hta") OR TERM("jar") OR TERM("js") OR TERM("out") OR TERM("plx") OR TERM("ps1")
  OR TERM("py") OR TERM("pyc") OR TERM("rgs") OR TERM("script") OR TERM("sct") OR
  TERM("server") OR TERM("vb") OR TERM("ws") OR TERM("docm") OR TERM("dotm") OR TERM("xlm")
  OR TERM("xlsm") OR TERM("xltm") OR TERM("xla") OR TERM("xlam") OR TERM("xll") OR
  TERM("otm") OR TERM("pptm") OR TERM("potm") OR TERM("ppsm") OR TERM("sldm")) | regex
  file_name="\.(bat|bin|cmd|com|e_e|ex_|exe|hta|jar|js|out|plx|ps1|py|pyc|rgs|script|sct|server|vb|ws|docm|dotm|xlm|xlsm|xltm|xla|xlam|xll|otm|pptm|potm|ppsm|sldm)$"
  | regex file_path!="C:\x5cWindows\x5cTemp\x5c__PSScriptPolicyTest_\S+ps1" | eventstats
  c(file_path) as c_file_path by file_path| eventstats c(file_name) as c_file_name
  by file_name|where c_file_path < 10 AND c_file_name < 10 | table _time, host, user
  dest, direction, dvc, dvc_nt_host, event_id, eventtype, file_name, file_path, parent_process_id,
  process_id, process_name, process_path, signature_id, tag, user_id | bin span=1s
  | stats values(*) as * by _time, host, file_path '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656

id: '32312.57469'
title: Git Spawns System32 Process
description: 'Adversaries may abuse command and script interpreters to execute commands,
  scripts, or binaries with the help of Git hooks. These interfaces and languages
  provide ways of interacting with computer systems and are a common feature across
  many different platforms. Most systems come with some built-in command-line interface
  and scripting capabilities, for example, Windows installations include the Windows
  Command Shell and PowerShell. This use case detects Git hooks spawning a System32
  process. Note: for best rule fidelity, Windows Event or Sysmon process creation
  logs are recommended due to their detailed parent process path information. Vulnerability
  reference: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(git) OR TERM(gh)) "C:\\Windows\\system32"
  | where match(process, "(?i)C:\x5cWindows\x5csystem32") and match(parent_process_path,
  "(?i)\x5cgit\x5c") and not match(process, "(?i)\x5c\?\?\x5cC:\x5cWindows\x5csystem32\x5cconhost\.exe\s+0xffffffff\s+-ForceV1")
  | table _time, host, user, parent_process_name, parent_process_path, process_path,
  process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://amalmurali.me/posts/git-rce/
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002

id: '33319.58975'
title: Impacket Lateral Movement Activity
description: Impacket is a collection of Python classes for working with network protocols,
  primarily focused on providing tools and scripts that facilitate the interaction
  with network services and protocols commonly used in network penetration testing
  and red teaming. wmiexec, smbexec, and dcomexec are specific tools within the Impacket
  suite that use various protocols to execute commands on remote systems. This use
  case detects specific behavior patterns associated with Impacket tools wmiexec,
  smbexec, and dcomexec.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("&1" OR "&amp;1") (("wmiprvse.exe" OR "mmc.exe"
  OR "explorer.exe" OR "services.exe") (("cmd.exe" OR "powershell.exe" OR "pwsh.exe")
  ("/Q" "/c") OR ("-c" OR "-command"))) OR ("svchost" ("cmd" OR "powershell" OR "pwsh")
  ("/C" OR -c" OR -command") "Windows\\Temp") | where ((match(parent_process_name,
  "(?i)(wmiprvse|mmc|explorer|services)\.exe") and match(process, "(?i)(cmd|powershell|pwsh)\.exe\s(\/Q)?\s(\/|-)c(ommand)?\s"))
  or (match(parent_process_name, "(?i)svchost\.exe") and match(process, "(?i)(powershell|pwsh|cmd)\.exe\s(\/|-)c(ommand)?\s.+Windows\x5cTemp\x5c")))
  | table _time, host, user, parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
- lateral-movement:exploitation of remote services
technique_id:
- T1021.002
- T1210
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1047/
- https://attack.mitre.org/techniques/T1021/003/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement/?query=10c14723-61c7-4c75-92ca-9af245723ad2
- https://github.com/fortra/impacket/tree/master

name: Impacket Lateral Movement smbexec CommandLine Parameters
id: bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
version: 11
creation_date: '2023-04-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns indicative of Impacket tool usage. This activity is significant as both Red Teams and adversaries use Impacket for remote code execution and lateral movement. If confirmed malicious, this activity could allow attackers to execute commands on remote endpoints, potentially leading to unauthorized access, data exfiltration, or further compromise of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process,"(?i)echo\s+cd") AND match(process, "(?i)\\__output") AND  match(process, "(?i)C:\\\\Windows\\\\[a-zA-Z]{1,8}\\.bat")  AND match(process, "\\\\127\.0\.0\.1\\.*") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_smbexec_commandline_parameters_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://attack.mitre.org/techniques/T1021/003/
    - https://attack.mitre.org/techniques/T1047/
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/techniques/T1053/005/
    - https://github.com/SecureAuthCorp/impacket
    - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
finding:
    title: Suspicious command-line parameters on $dest$ may represent lateral movement using smbexec.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - WhisperGate
    - Active Directory Lateral Movement
    - Volt Typhoon
    - Prestige Ransomware
    - Industroyer2
    - Data Destruction
    - Graceful Wipe Out Attack
    - Compromised Windows Host
    - CISA AA22-277A
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
    - T1021.003
    - T1047
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux OpenVPN Privilege Escalation
id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of OpenVPN with elevated privileges, specifically when combined with the `--dev`, `--script-security`, `--up`, and `sudo` options. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and execution details. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute system commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access and execute arbitrary commands with elevated privileges.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*openvpn*"
        AND
        Processes.process="*--dev*"
        AND
        Processes.process="*--script-security*"
        AND
        Processes.process="*--up*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_openvpn_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/openvpn/
    - https://en.wikipedia.org/wiki/OpenVPN
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Bootloader Modification
id: 97fd4330-bd47-4742-abaf-c877d404822a
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |-
    The following analytic detects processes modifying data in the EFI volume on Linux.
    These files are responsible for initializing the Boot Manager during system startup.
    Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process_name IN (
            "cp",
            "mv",
            "ln"
        )
        Processes.process_current_directory="*/EFI/BOOT*"
    )
    OR
    (
        Processes.process="*/EFI/BOOT*"
        NOT Processes.process_name IN (
            "ls",
            "grep",
            "egrep"
        )
    )

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_bootloader_modification_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity.
references:
    - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
    - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/
finding:
    title: Possible bootloader modification identified via [$process$] by [$user$] on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Possible bootloader modification via [$process$] by [$user$] on [$dest$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Rootkit
    - Data Destruction
    - Linux Persistence Techniques
asset_type: Endpoint
cve:
    - CVE-2024-7344
mitre_attack_id:
    - T1542.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux SSH Authorized Keys Modification
id: f5ab595e-28e5-4327-8077-5008ba97c850
version: 14
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("bash","cat") Processes.process IN ("*/authorized_keys*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ssh_authorized_keys_modification_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Filtering will be required as system administrators will add and remove. One way to filter query is to add "echo".
references:
    - https://redcanary.com/blog/lateral-movement-with-secure-shell/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ modifying SSH Authorized Keys.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ modifying SSH Authorized Keys.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
    - Hellcat Ransomware
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1098.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '26010.48255'
title: Microsoft SQL Server Suspicious Child Process - Windows
description: 'sqlservr.exe is the primary executable for Microsoft SQL Server. Compromised
  SQL databases may be leveraged to gain footholds for further network exploitation.
  This use case detects executions of commonly abused binaries with parent process
  sqlservr.exe. Unexpected executions can indicate SQL injection or RCE. -- Threat
  Actor Association: FIN7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(sqlservr) OR "sqlservr.exe") (TERM(bash)
  OR TERM(bitsadmin) OR TERM(cmd) OR TERM(net) OR TERM(netstat) OR TERM(nltest) OR
  TERM(mshta) OR TERM(ping) OR TERM(powershell) OR TERM(pwsh) OR TERM(regsvr32) OR
  TERM(rundll32) OR TERM(sh) OR TERM(systeminfo) OR TERM(tasklist) OR TERM(ps) OR
  TERM(at) OR TERM(schtasks) OR TERM(wsl) OR "bash.exe" OR "bitsadmin.exe" OR "cmd.exe"
  OR "net.exe" OR "netstat.exe" OR "nltest.exe" OR "mshta.exe" OR "ping.exe" OR "powershell.exe"
  OR "pwsh.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "sh.exe" OR "systeminfo.exe"
  OR "tasklist.exe" OR "ps.exe" OR "at.exe" OR "schtasks.exe" OR "wsl.exe") | where
  match(parent_process_name, "(?i)sqlservr\.exe") and match(process_path, "(?i)\x5c(bash|bitsadmin|cmd|net|netstat|nltest|mshta|ping|powershell|pwsh|regsvr32|rundll32|sh|systeminfo|tasklist|ps|at|schtasks|wsl)\.exe")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- persistence:server software component:sql stored procedures
- initial-access:exploit public-facing application
technique_id:
- T1505.001
- T1190
data_category:
- Windows event logs
references:
- https://www.securonix.com/blog/securonix-threat-research-security-advisory-new-returgence-attack-campaign-turkish-hackers-target-mssql-servers-to-deliver-domain-wide-mimic-ransomware/

name: O365 Multiple Service Principals Created by SP
id: ef4c3f20-d1ad-4ad1-a3f4-d5f391c005fe
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where a single service principal creates more than three unique OAuth applications within a 10-minute timeframe. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in the Office 365 Azure Active Directory environment. This activity is significant as it may indicate a compromised or malicious service principal attempting to expand control or access within the network. If confirmed malicious, this could lead to unauthorized access and potential lateral movement within the environment, posing a significant security risk.
data_source:
    - O365 Add service principal.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Add service principal.\" | bucket span=10m _time | eval len=mvcount('Actor{}.ID') | eval userType = mvindex('Actor{}.ID',len-1) | search userType = \"ServicePrincipal\" | eval displayName = object | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(displayName) as displayName dc(displayName) as unique_apps values(user) as user values(src) as src by src_user vendor_account vendor_product dest signature | where unique_apps > 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_multiple_service_principals_created_by_sp_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple OAuth applications were created by $src_user$ in a short period of time
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '19348.33710'
title: Potential nanodump execution
description: Nanodump is a flexible tool that creates a minidump of the LSASS process
  and is commonly used by red teams with cobalt strike. This use case looks for nanodumps
  default access requests.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
  "<EventID>4656<") "0x1010" ) OR ((TERM(EventCode=4663) OR "<EventID>4663<") "%%4484"
  ) "lsass.exe" | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=5s | stats values(*) as * by _time, host | where match(signature_id,
  "4656") and match(signature_id, "4663") '
techniques:
- credential-access:os credential dumping
technique_id: T1003
data_category:
- Windows event logs
references:
- https://github.com/fortra/nanodump

id: '33791.59818'
title: Process Execution From Suspicious Folder
description: Threat actors may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and security tools. Masquerading
  involves altering the name or location of an object, whether legitimate or malicious,
  to evade defenses and avoid detection. This technique can include modifying file
  metadata, misleading users about the file type, and using names that resemble legitimate
  tasks or services. This use case detects processes executed from a suspicious folder.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("\\$Recycle.bin\\" OR "\\config\\systemprofile\\"
  OR "\\Intel\\Logs\\" OR "\\RSA\\MachineKeys\\" OR ("\\Users\\" ("\\Public\\" OR
  "\\All Users\\" OR "\\Default\\" OR "\\NetworkService\\")) OR ("\\Windows\\" ("\\addins\\"
  OR "\\debug\\" OR "\\Fonts\\" OR "\\Help\\" OR "\\IME\\" OR "\\Media\\" OR "\\repair\\"
  OR "\\security\\" OR "\\System32\\Tasks\\" OR "\\Tasks\\")) OR "C:\\Perflogs\\")
  OR "\\Users\\Public" | regex process_path="(?i)(\x5c\$Recycle\.bin\x5c|\x5cconfig\x5csystemprofile\x5c|\x5cIntel\x5cLogs\x5c|\x5cRSA\x5cMachineKeys\x5c)|(\x5cUsers\x5c(Public|All\s+Users|Default|NetworkService)\x5c)|(\x5cWindows\x5c(addins|debug|Fonts|Help|IME|Media|repair|security|System32\x5cTasks|Tasks)\x5c)|^C:\x5cPerflogs\x5c"|
  regex parent_process_path!="(?i)(^C:\x5cUsers\x5cPublic\x5cIBM\x5cClientSolutions\x5cStart_Programs\x5c)"|
  regex parent_process_path!="(?i)(^C:\x5cWindows\x5cSysWOW64\x5cconfig\x5csystemprofile\x5cCitrix\x5cUpdaterBinaries\x5c\S+\CitrixReceiverUpdater\.exe)"
  | table _time, host, user, process, parent_*, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:masquerading
technique_id: 
- T1036
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1036/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml
- https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection

id: '24501.45204'
title: PuTTY Secure Copy Client Execution
description: pscp.exe is a tool in the PuTTY suite used for secure copy and has been
  used by threat actors including BlackCat and Agrius to exfiltrate data. This use
  case detects executions of pscp.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=1) OR "EventID>1<")
  OR (TERM(EventCode=3) OR "EventID>3<")) "pscp.exe" | table _time, host, user process,
  process_*, signature_id, parent_* | bin span=60s | stats values(*) as * by _time,
  host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- Windows Sysmon
references:
- https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
- https://www.trendmicro.com/en_us/research/23/f/malvertising-used-as-entry-vector-for-blackcat-actors-also-lever.html

id: '39090.70293'
title: RDP File Executed from Outlook Temp Directory
description: Remote desktop is a common feature in operating systems. It allows a
  user to log into an interactive session with a system desktop graphical user interface
  on a remote system. Targeted spear-phishing campaigns attributed to Russia’s APT29
  have been observed distributing .rdp files to victims to initiate a remote connection.
  This use case detects the execution of .rdp files in the temporary directory that
  Outlook uses when opening attachments.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ".rdp" ("\\AppData\\Local\\Packages\\Microsoft.Outlook_" OR ("\\AppData\\Local\\Microsoft\\Windows\\"
  "\\Content.Outlook\\"))| where match(process, "(?i)((\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c.*\x5cContent\.Outlook\x5c)|(\x5cAppData\x5cLocal\x5cPackages\x5cMicrosoft\.Outlook_)).*\.rdp")
  | table _time, host, user, process_*, process, parent_*, file_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:phishing:spearphishing attachment
technique_id:
- T1021.001
- T1566.001
data_category:
- Windows Sysmon
references:
- https://x.com/cyb3rops/status/1851880158640099675?s=46
- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
- https://cert.gov.ua/article/6281076
- https://aws.amazon.com/blogs/security/amazon-identified-internet-domains-abused-by-apt29/
- https://github.com/SigmaHQ/sigma/pull/5063/files