Splunk rules: 28

id: '30662.54790'
title: ADExplorer Execution
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
  suite that allows users to view, search, and analyze objects within Active Directory
  to understand its structure, object properties, and security settings. A threat
  actor might leverage AD Explorer to gain detailed insights into the AD environment,
  such as identifying privileged user accounts and network resources, which can be
  exploited to escalate privileges or facilitate lateral movement within a network.
  This use case detects executions of ADExplorer .
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ADExplorer64.exe" OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp" | regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"
  | table _time, host, user, parent_process_name, process, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer

name: AWS ECR Container Scanning Findings Medium
id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
version: 13
creation_date: '2021-08-18'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies medium-severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect vulnerabilities in container images. This activity is significant for a SOC as it highlights potential security risks in containerized applications, which could be exploited if not addressed. If confirmed malicious, these vulnerabilities could lead to unauthorized access, data breaches, or further exploitation within the container environment, compromising the overall security posture.
data_source:
    - AWS CloudTrail DescribeImageScanFindings
search: |-
    `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
      | spath path=responseElements.imageScanFindings.findings{} output=findings
      | mvexpand findings
      | spath input=findings
      | search severity=MEDIUM
      | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product finding_name
           finding_description imageDigest repository
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_ecr_container_scanning_findings_medium_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Vulnerabilities with severity medium found in repository $repository$
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: AWS S3 Exfiltration Behavior Identified
id: 85096389-a443-42df-b89d-200efbb1b560
version: 10
creation_date: '2023-05-04'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Correlation
description: The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message FROM datamodel=Risk.All_Risk
      WHERE All_Risk.annotations.mitre_attack.mitre_tactic = "collection"
        OR
        All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS*
      BY All_Risk.risk_object
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 2 and mitre_tactic_id_count>=2
    | `aws_s3_exfiltration_behavior_identified_filter`
how_to_implement: You must enable all the detection searches in the Data Exfiltration Analytic story to create risk events in Enterprise Security.
known_false_positives: False positives may be present based on automated tooling or system administrators. Filter as needed.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
    - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
finding:
    title: Suspicious AWS S3 exfiltration behavior identified - $risk_object$
    entity:
        field: risk_object
        type: other
        score: 0
analytic_story:
    - Suspicious Cloud Instance Activities
    - Data Exfiltration
asset_type: AWS Account
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Secure Firewall - High Volume of Intrusion Events Per Host
id: 9f2295a0-0dcb-4a5f-b013-8a6f2a3c11f6
version: 8
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. It leverages Cisco Secure Firewall Threat Defense logs, specifically focusing on the IntrusionEvent event type, to identify hosts that trigger more than 15 Snort-based signatures during that time. A sudden spike in intrusion alerts originating from a single host may indicate suspicious or malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. In some cases, this behavior may also be caused by misconfigured or outdated software repeatedly tripping detection rules. Systems exhibiting this pattern should be triaged promptly, as repeated Snort rule matches from a single source are often early indicators of compromise, persistence, or active exploitation attempts.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent
    | bin _time span=30m
    | stats count as TotalEvents values(signature_id) as signature_id
            values(signature) as signature
            values(dest) as dest
            values(dest_port) as dest_port
            min(_time) as firstTime max(_time) as lastTime
            by src class_desc MitreAttackGroups InlineResult InlineResultReason rule transport app
    | where TotalEvents >= 15
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___high_volume_of_intrusion_events_per_host_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: |
    False positives can occur in environments where vulnerability scanners or malware sandboxes are actively generating simulated attacks. Additionally, noisy or overly aggressive Snort rules may produce bursts of alerts from legitimate applications. Review host context before escalating.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A high number [$TotalEvents$] of Snort intrusion detections for [$signature$] were triggered by [$src$] in a 30-minute time window.
threat_objects:
    - field: signature
      type: signature
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1059 # Command and Scripting Interpreter
    - T1071 # Application Layer Protocol
    - T1595.002 # Active Scanning: Vulnerability Scanning
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: GetWmiObject DS User with PowerShell Script Block
id: fabd364e-04f3-11ec-b34b-acde48001122
version: 12
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_User` class parameter via PowerShell Script Block Logging (EventCode=4104). It leverages logs to identify attempts to query all domain users using WMI. This activity is significant as it may indicate an adversary or Red Team operation attempting to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, enabling attackers to map out the network and identify potential targets for privilege escalation or lateral movement.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://www.blackhillsinfosec.com/red-blue-purple/
    - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace
finding:
    title: powershell process having commandline for user enumeration detected on host - $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: powershell process having commandline for user enumeration detected on host - $dest$
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '29739.53745'
title: Impacket atexec.py  Execution
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case process creation events matching characteristics of Impacket
  atexec.py executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("cmd.exe" OR "powershell.exe" OR "pwsh.exe") " /c " "\\Windows\\Temp" ("2&gt;&amp;1"
  OR "2&>1") | regex parent_process="(?i)Temp\x5c[A-Za-z]{8}\.tmp" | table _time,
  host, user, process, parent_process_name, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Kubernetes AWS detect suspicious kubectl calls
id: 042a3d32-8318-4763-9679-09db2644a8f2
version: 9
creation_date: '2020-06-23'
modification_date: '2026-05-13'
author: Rod Soto, Patrick Bareiss, Splunk
status: experimental
type: Anomaly
description: The following analytic detects anonymous and unauthenticated requests to a Kubernetes cluster. It identifies this behavior by monitoring API calls from users who have not provided any token or password in their request, using data from `kube_audit` logs. This activity is significant for a SOC as it indicates a severe misconfiguration, allowing unfettered access to the cluster with no traceability. If confirmed malicious, an attacker could gain access to sensitive data or control over the cluster, posing a substantial security risk.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` user.username="system:anonymous" user.groups{} IN ("system:unauthenticated")
      | fillnull
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_aws_detect_suspicious_kubectl_calls_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Suspicious kubectl API calls from $user$
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Local LLM Framework DNS Query
id: d7ceffc5-a45e-412b-b9fa-2ba27c284503
version: 3
creation_date: '2025-11-24'
modification_date: '2026-07-15'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Hunting
description: |
    Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services.
    Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to repositories such as huggingface.co and ollama.ai for model downloads, updates, and telemetry.
    These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.
data_source:
    - Sysmon EventID 22
search: |
    `sysmon`
    EventCode=22
    QueryName IN (
        "*anthropic*",
        "*api.openrouter*",
        "*civitai*",
        "*dashscope.aliyuncs*",
        "*gpt4all*",
        "*huggingface*",
        "*jan.ai*",
        "*koboldai*",
        "*lmstudio*",
        "*modelscope*",
        "*nomic.ai*",
        "*ollama*",
        "*oobabooga*",
        "*openai*",
        "*openrouter*",
        "*replicate*",
        "*tongyi*"
    )
    NOT (
        Image IN (
            "*\\360se.exe", "*\\arc.exe", "*\\atlas.exe", "*\\avastbrowser.exe",
            "*\\avgbrowser.exe", "*\\blpbrowser.exe", "*\\brave.exe", "*\\braveupdate.exe",
            "*\\chrome.exe", "*\\chromium.exe", "*\\Cisco\\Cisco Secure Client\\ThousandEyes Endpoint Agent\\*",
            "*\\coccoc.exe", "*\\dragon.exe", "*\\duckduckgo.exe", "*\\epic.exe",
            "*\\firefox.exe", "*\\ghost.exe", "*\\iexplore.exe", "*\\iridium.exe",
            "*\\iron.exe", "*\\maxthon.exe", "*\\microsoftedge.exe", "*\\microsoftedgeupdate.exe",
            "*\\msedge.exe", "*\\msedgewebview2.exe", "*\\MsMpEng.exe", "*\\opera_autoupdate.exe",
            "*\\opera.exe", "*\\perplexity.exe", "*\\rave.exe", "*\\safari.exe", "*\\shift.exe",
            "*\\sidekick.exe", "*\\thorium.exe", "*\\torch.exe", "*\\vivaldi.exe",
            "*\\wavebrowser.exe", "*\\whale.exe", "*\\zen.exe", "C:\\ProgramData\\*",
            "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*"
        )
        OR
        (
            Image IN ("*\\AnthropicClaude\\Update.exe", "*\\claude.exe")
            QueryName = "anthropic.com"
        )
        OR
        (
            Image = "*\\lm studio.exe"
            QueryName = "lmstudio.ai"
        )
        OR
        (
            Image IN ("*\\ollama app.exe", "*\\ollama.exe")
            QueryName = "ollama.com"
        )
        OR
        (
            Image IN ("*\\chatgpt.exe", "*\\codex.exe")
            QueryName = "openai.com"
        )
    )
    | stats count
        min(_time) as firstTime
        max(_time) as lastTime
        by src Image process_name QueryName query_count answer answer_count reply_code_id vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `local_llm_framework_dns_query_filter`
how_to_implement: |
    Ensure Sysmon is deployed across Windows endpoints and configured to capture DNS query events (Event ID 22). Configure Sysmon's XML configuration file to log detailed command-line arguments, parent process information, and full process image paths. Ingest Sysmon event logs into Splunk via the Splunk Universal Forwarder or Windows Event Log Input, ensuring they are tagged with `sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`. Verify the `sysmon` macro exists in your Splunk environment and correctly references the Sysmon event logs. Create or update the `unauthorized_local_llm_framework_usage_filter` macro in your detections/filters folder to exclude approved systems, authorized developers, sanctioned ML/AI workstations, or known development/lab environments as needed. Deploy this hunting search to your Splunk Enterprise Security or Splunk Enterprise instance and schedule it to run on a regular cadence to detect unauthorized LLM model DNS queries and shadow AI activities. Correlate findings with endpoint asset inventory and user identity data to prioritize investigation.
known_false_positives: |
    Legitimate DNS queries to LLM model hosting platforms by authorized developers, ML engineers, and researchers during model training, fine-tuning, or experimentation. Approved AI/ML sandboxes and lab environments where LLM model downloads are expected. Automated ML pipelines and workflows that interact with LLM model hosting services as part of their normal operation. Third-party applications and services that access LLM model platforms for legitimate purposes.
references:
    - https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
    - https://www.splunk.com/en_us/blog/artificial-intelligence/splunk-technology-add-on-for-ollama.html
    - https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
analytic_story:
    - Suspicious Local LLM Frameworks
asset_type: Endpoint
mitre_attack_id:
    - T1590
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Malicious InProcServer32 Modification
id: 127c8d08-25ff-11ec-9223-acde48001122
version: 11
creation_date: '2021-10-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects a process modifying the registry with a known malicious CLSID under InProcServer32. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications within the HKLM or HKCU Software Classes CLSID paths. This activity is significant as it may indicate an attempt to load a malicious DLL, potentially leading to code execution. If confirmed malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or escalate privileges, posing a severe threat to system integrity and security.
data_source:
    - Sysmon EventID 12
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.
references:
    - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
    - https://tria.ge/210929-ap75vsddan
    - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
finding:
    title: A process identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Suspicious Regsvr32 Activity
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1218.010
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35820.62790'
title: Mega Utility Execution - Windows
description: Mega is a cloud storage service used by many threat actors due to its
  use of end-to-end encryption and semi-anonymous payment options. The client application
  MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate
  large amounts of data. This use case detects process executions of MEGASync or MegaCMD.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "Megasync.exe" OR "megacmd" | regex process_name="(?i)megasync\.exe|megacmd"
  | table _time, host, user process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Windows event logs
references:
- https://redcanary.com/blog/threat-detection/rclone-mega-extortion/
- https://mega.io/

name: O365 Email Receive and Hard Delete Takeover Behavior
id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3
version: 6
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
data_source:
    - Office 365 Universal Audit Log
    - Office 365 Reporting Message Trace
search: |-
    `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
    | eval mailtime = _time
    | bin _time span=4hr
    | eval user = lower(RecipientAddress)
    | eval InternetMessageId = lower(MessageId)
    | join InternetMessageId, user max=0
      [
      | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")
      | spath path=AffectedItems{}  output=AffectedItemSplit
      | fields _time,ClientProcessName,ClientIPAddress,ClientInfoString,UserId,Operation,ResultStatus,MailboxOwnerUPN,AffectedItemSplit,Folder.Path
      | mvexpand AffectedItemSplit | spath input=AffectedItemSplit
      | search Subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
      | eval deltime = _time
      | bin _time span=4hr
      | eval InternetMessageId = lower(InternetMessageId), user = lower(UserId), subject = Subject
      ]
    | stats values(ClientIPAddress) as src, values(ClientInfoString) as http_user_agent, values(Folder.Path) as file_path, values(Operation) as signature, values(ResultStatus) as result, values(InternetMessageId) as signature_id, count, min(mailtime) as firstTime, max(deltime) as lastTime by user,subject
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_receive_and_hard_delete_takeover_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
known_false_positives: Possible new user/account onboarding processes.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ received and deleted an email within a short timeframe titled [$subject$] which may contain password or banking information
threat_objects:
    - field: src
      type: ip_address
    - field: subject
      type: email_subject
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Suspicious Emails
    - Data Destruction
asset_type: O365 Tenant
mitre_attack_id:
    - T1070.008
    - T1485
    - T1114.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '19129.34174'
title: Potential Cryptomining Commands
description: Adversaries may leverage the resources of co-opted systems in order to
  solve resource intensive problems, which may impact system and/or hosted service
  availability. One common purpose for Resource Hijacking is to validate transactions
  of cryptocurrency networks and earn virtual currency. This use case detects common
  plaintext and base64 encoded commands for cryptomining activity.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("--cpu-priority=" OR "--donate-level=" OR " -o pool." OR " --nicehash"
  OR " --algo=" OR "stratum+tcp://" OR "stratum+udp://" OR "LS1kb25hdGUtbGV2ZWw9"
  OR "0tZG9uYXRlLWxldmVsP" OR "tLWRvbmF0ZS1sZXZlbD" OR "c3RyYXR1bSt0Y3A6Ly" OR "N0cmF0dW0rdGNwOi8v"
  OR "zdHJhdHVtK3RjcDovL" OR "c3RyYXR1bSt1ZHA6Ly" OR "N0cmF0dW0rdWRwOi8v" OR "zdHJhdHVtK3VkcDovL")
  | regex process!="(?i)(pool\.(c|o))\s|gcc\s-" | table _time, host, user, process,
  process_*, parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- impact:resource hijacking
technique_id: 
- T1496
data_category:
- PowerShell logs
references:
- https://xmrig.com/docs/miner/command-line-options
- https://www.trendmicro.com/en_us/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html

id: '19995.35576'
title: Potential Target Discovery via PowerShell Event Log Queries
description: 'Threat actors may use custom scripts during discovery activities to
  identify targets on a network. This use case detects PowerShell scripts querying
  System, Security, and Windows Terminal Services event logs as observed with RagnarLocker.
  -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard,
  Pawn Storm, TA422, STRONTIUM) - Software Association: RagnarLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Get-EventLog) OR
  TERM(Get-WinEvent)) ("7001" OR "7002" OR "21" OR "25" OR "4624") | table _time,
  host, user process, process_*, signature_id | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- discovery:system information discovery
technique_id: 
- T1082
data_category:
- PowerShell logs
references:
- https://blog.sygnia.co/threat-actor-spotlight-ragnarlocker-ransomware?_ga=2.100185502.1673284611.1684933734-1923873697.1682517767
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Python Site Hooks Creation During Package Installation
id: efaf40f5-779f-4b48-a941-b7d1a7c931ed
version: 1
creation_date: '2026-08-21'
modification_date: '2026-08-21'
author: Onur Mustafa Erdogan, Splunk
status: production
type: TTP
description: |-
    The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
    Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
    If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
    The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: |-
    `sysmon`
    EventID IN (1,11)
    (
        process="* install *"
        OR
        (
            action="created"
            file_path="*-packages\\*"
            file_path IN ("*sitecustomize.py", "*usercustomize.py")
        )
    )

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(parent_process_id) as parent_process_id
                  values(parent_process_path) as parent_process_path
                  values(parent_process_name) as parent_process_name
                  values(parent_process) as parent_process
                  values(process_path) as process_path
                  values(process_name) as process_name
                  values(process) as process
                  values(file_path) as file_path
                  values(file_name) as file_name
                  dc(EventID) as dc_event_id
                  by dest source process_id

    | search dc_event_id>1

    | table firstTime lastTime
            parent_process_id parent_process_path parent_process_name parent_process
            process_id process_path process_name process
            file_path file_name
            dest source

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `python_site_hooks_creation_during_package_installation_filter`
how_to_implement: |-
    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
    and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py
    extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the
    Splunk Common Information Model (CIM).
known_false_positives: |-
    Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py`
    as part of normal setup. Investigate the file contents and parent process to determine legitimacy.
references:
    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
finding:
    title: A Python site hook file [$file_path$] was created on [$dest$] during package installation using [$process$].
    entity:
        field: dest
        type: system
        score: 40
threat_objects:
    - field: process
      type: process
    - field: file_path
      type: file_path
    - field: file_name
      type: file_name
analytic_story:
    - Malicious Python Package Installation
    - Compromised Windows Host
    - Windows Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1546
    - T1195.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '9037.12148'
title: RDP Connection
description: 'This use case looks for when an RDP network connection has been established.
  -- Threat Actor Association: Agrius, APT35/Phosphorus/Magic Hound, Daixin Team,
  Flax Typhoon, Karakurt, Lapsus$, Muddled Libra, Scattered Spider (aka. 0ktapus,
  UNC3944), UNC5221, UTA0178 - Software Association: Akira, AvosLocker, BianLian,
  Blackcat/ALPHV, BlackByte, Lockbit, LV, Play, Quantum, Ransom Cartel, Rhysida, Royal,
  Snatch, Trigona'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=3 OR "Event>ID>3<")
  (TERM(3389) OR TERM(RDP)) | table _time, host, user dest, direction, event_id, eventtype,
  parent_*, process, process_*, user, user_id, src_*, dest_* | bin span=1s | stats
  values(*) as * by _time, host | where match(dest_port, "(?i)3389|rdp") or match(src_port,
  "(?i)3389|rdp") '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:external remote services
technique_id:
- T1021.001
- T1133
data_category:
- Process use of network
- Windows Sysmon
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

id: '17778.29995'
title: Read-Only Attribute Removed - Windows
description: 'This use case detects commands removing read-only attributes from files
  on Windows systems. This technique is used by threat actors to modify or delete
  critical system files. Atomics T1222.001 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(attrib) OR TERM(attrib.exe))
  "-r" | regex process="(?i)\s+-r\s+" | table _time, host, user parent_*, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-3---attrib---remove-read-only-attribute

id: '6732.7877'
title: Registry key added with reg.exe
description: 'Reg is a Windows utility used to interact with the Windows Registry.
  It can be used at the command-line interface to add information. -- Threat Actor
  Association: APT35/Phosphorus/Magic Hound, APT37, APT41, FIN6, Flax Typhoon, Gorgon
  Group, Harvester, Lazarus, TA428, UNC2465, Vice Society, Witchetty -- Software Association:
  BianLian, BlackByte, Blackcat/ALPHV, Conti, Hive, Lorenz, Prestige, SmokedHAM, Snatch,
  Sodinokibi/REvil, Remcos, WIRTE, Vice Society, XingLocker, Zumkong -- Atomics T1021.001
  Test #4 Atomics T1546.010 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "reg" ("add" OR "import") | table _time, host, user user, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://unit42.paloaltonetworks.com/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/

id: '26999.49289'
title: rundll32 with No DLL in Command Line
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Typical usage would involve specifying a DLL file and
  a function to execute. Because rundll32 is a trusted system utility with the ability
  to execute code, it is a high value target for abuse by threat actors. This use
  case detects executions of rundll32.exe without a .dll referenced in the command
  line. Benign false positives from Internet Explorer parent processes have been filtered
  out. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(rundll32) OR "rundll32.exe" | where (match(process_name, "(?i)rundll32\.exe")
  and not match(process, "(?i)(^\"C:\x5cWindows\x5csystem32\x5crundll32\.exe\"$)|(\.dll)"))
  and (not match(parent_process_name, "(?i)iexplore\.exe") and not match(process,
  "(?i)InetCpl\.cpl\,ClearMyTracksByProcess")) | table _time, host, user, process,
  process_*, parent_process, parent_process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

id: '6000.6379'
title: Suspicious Powershell
description: 'PowerShell commands/scripts can also be executed without directly invoking
  the powershell.exe binary. This use case attempts to identify those powershell executions
  launched by a binary other than powershell. -- Threat Actor Association: APT35/Charming
  Kitten/Phosphorus, TA576 - Software Association: BATLoader, XWorm'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) NOT
  powershell.exe | rex field=Message "(?i)host\s+application\s+\=(?<process_path1>.+?\.exe")|
  where isnotnull(process_path1)| regex process_path1!="(?i)powershell(\_ISE)?\.exe"
  | eval process_path=mvappend(process_path, process_path1) | table _time, host, user,
  event_id, signature_id, process_*, process | bin span=10s | stats values(*) as *
  by _time, host, process_path1 '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/fdiskyou/PowerOPS

name: System User Discovery With Whoami
id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
version: 12
creation_date: '2021-08-24'
modification_date: '2026-08-30'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `whoami.exe` without any arguments. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because both Red Teams and adversaries use `whoami.exe` to identify the current logged-in user, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could indicate an attacker is gathering information to further compromise the system, potentially leading to privilege escalation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="whoami.exe"
            OR
            Processes.original_file_name="whoami.exe"
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `system_user_discovery_with_whoami_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1033/
analytic_story:
    - Winter Vivern
    - Active Directory Discovery
    - Rhysida Ransomware
    - Qakbot
    - CISA AA23-347A
    - PHP-CGI RCE Attack on Japanese Organizations
    - LAMEHUG
    - Lotus Blossom Chrysalis Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint