Splunk rules: 29

id: '22489.40177'
title: Bypass or Unrestricted PowerShell Execution
description: 'This use case identifies instances where PowerShell is executed with
  specific, potentially insecure execution policies such as Unrestricted, Bypass,
  or RemoteSigned. Threat actors may exploit these settings to execute malicious scripts
  or commands, as they allow scripts to run without the usual restrictions and without
  requiring digital signatures. -- Threat Actor Association: UNC4990 - Software Association:
  Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (" -ExecutionPolicy
  " OR " -ep " OR " -exec ") ("Unrestricted" OR "bypass" OR "RemoteSigned") | where
  not match(process, "(?i):\x5c(Program\sFiles|ProgramData|AppData\x5cRoaming\x5cCode\x5c)")
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
- https://adsecurity.org/?p=2604
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1

id: '1025.1026'
title: Create_Add Local_Domain User
description: 'Detects the addition of a nonprivileged user that is added to a privileged
  local or domain group, or when a user is created. -- Threat Actor Association: Alloy
  Taurus/Gallium, APT29, APT35/Phosphorus/Magic Hound, CL-STA-0043, DarkSide, BlackMatter,
  FIN12, Lapsus$, Lazarus, Phosphorus/Magic Hound/APT35, UNC2596 -- Software Association:
  Akira, Avos, Bazarloader, BianLian, Blackbyte, Blackcat/ALPHV, Cactus, Conti, Cring,
  Cuba, Hafnium, Insekt, Lockbit, Qakbot/Qbot, Royal, SmokedHAM, TargetCompany, Trigona,
  Vice Society - Atomics T1078.003 Test#1 Atomics T1136.001 Test#3 Atomics T1136.001
  Test#4 Atomics T1136.001 Test#6 Atomics T1136.002 Test#1 Atomics T1136.002 Test#2
  Atomics T1136.002 Test#3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (((EventCode=4688 OR Type=Process
  OR "<EventID>4688<") AND "net.exe" AND "add" ) OR (EventCode=4720 OR "<EventID>4720<")
  OR ((EventCode=4732 OR "<EventID>4732<") AND ( "Administrators" OR "Users" OR "Remote"
  ))) | rex field=process "(?i)net.*?user(.*?add)?\s+(?<dest_user1>\S+")| rex field=process
  "(?i)net.*?group\s+(?<user_group1>\S+")| rex field=process "(?i)net.*?group\s+\S+\s+(?<dest_user2>\S+")|
  eval user_group=coalesce(user_group,user_group1), dest_user=coalesce(dest_user1,
  dest_user2, dest_user, user) | table _time, host, user dvc, dvc_nt_host, event_id,
  host, index, parameters, parent_process_id, parent_process_name, parent_process_path,
  process, process_id, process_name, process_path, signature_id, source, sourcetype,
  tag, user, user_group, dest_user | bin span=1s | stats values(*) as * by _time,
  host | where(match(process,"(?i).add") ANDmatch(process,"(?i)(\-u)|(user)|(localgroup)|(group)"))
  OR (match(user_group,"(?i)(users)|(administrators)|(remote)")) ORmatch(signature_id,"(?i)4720") '
techniques:
- persistence:account manipulation
- persistence:create account:local account
- persistence:create account:domain account
technique_id:
- T1098
- T1136.002
- T1136.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.sans.org/reading-room/whitepapers/logging/paper/37367

name: Crowdstrike Medium Severity Alert
id: 7e80d92a-6ec3-4eb1-a444-1480acfe2d14
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a CrowdStrike alert with MEDIUM severity indicates a potential threat that requires prompt attention. This alert level suggests suspicious activity that may compromise security but is not immediately critical. It typically involves detectable but non-imminent risks, such as unusual behavior or attempted policy violations, which should be investigated further and mitigated quickly to prevent escalation of attacks.
data_source: []
search: |-
    `crowdstrike_stream`
      | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY src_ip, src_host, user,
           description, type, count_alerts,
           severity
      | where LIKE (severity, "%MEDIUM%")
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_medium_severity_alert_filter`
how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A MEDIUM Severity Crowdstrike Alert found in $src_host$
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5691.18072'
title: Data Staged to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. Data may be kept in separate files or
  combined into one file through techniques such as Archive Collected Data. This use
  case looks for common output commands followed by a potential file extension. --
  Threat Actor Association: Actinium/Gamaredon/Primitive Bear, APT29/Nobelium, APT37,
  Arid Viper/APT C-23, Gorgon Group, Kimsuky, Memento Team, Wizard Spider, WIRTE --
  Software Association: Bazar, Conti, Remcos - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (">" OR ">>" OR "Out-File") | regex process="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}"
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
technique_id:
- T1074.001
data_category:
- Windows Sysmon
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

name: Domain Account Discovery with Dsquery
id: b1a8ce04-04c2-11ec-bea7-acde48001122
version: 13
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to discover domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to map out domain users, which is a common precursor to further attacks. If confirmed malicious, this behavior could allow attackers to gain insights into user accounts, facilitating subsequent actions like privilege escalation or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="dsquery.exe"
        AND
        Processes.process = "*user*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `domain_account_discovery_with_dsquery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
    - https://attack.mitre.org/techniques/T1087/002/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - LAMEHUG
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Organizations Repository Archived
id: 4f568a0e-896f-4d94-a2f7-fa6d82ab1f77
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a repository is archived in GitHub Organizations. The detection monitors GitHub Organizations audit logs for repository archival events by tracking actor details, repository information, and associated metadata. For a SOC, identifying repository archival is important as it could indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt development operations. The impact of unauthorized repository archival includes loss of active development access, disruption to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if proper backups are not maintained.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=repo.archived
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           org, org_id, repo,
           repo_id, user_agent, visibility,
           vendor_action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_repository_archived_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ archived a repository in GitHub Organizations
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1485
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Malformed Auth Entry
id: 962602e9-08ae-47ff-af89-a1e83f461a26
version: 1
creation_date: '2026-05-06'
modification_date: '2026-05-06'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects when su runs from a page-cache-corrupted binary.
    When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
    Under normal conditions, su logs both the target account and the invoking user.
    When exploitation has occurred via this path, the invoking username field is absent.
    This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
    If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
data_source:
    - Linux Secure
search: |
    sourcetype=linux_secure process=su
    | rex "su:\s+\(to\s+(?<target_user>\S+)\)(?<source_user>\s{2,})on\s+(?<terminal>\S+)"
    | where len(ltrim(source_user)) == 0
    | stats
        count                        as total_attempts,
        min(_time)                   as firstTime,
        max(_time)                   as lastTime,
        values(target_user)          as target_users,
        values(host)                 as dest
        by process

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_malformed_auth_entry_filter`
how_to_implement: |-
    To successfully implement this search, you need to have relevant authentication logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
known_false_positives: No false positives have been identified at this time.
references:
    - https://xint.io/blog/copy-fail-linux-distributions
    - https://github.com/theori-io/copy-fail-CVE-2026-31431
    - https://github.com/Neo23x0/auditd/blob/master/audit.rules
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Malformed authentication entry on $dest$ indicating possible privilege escalation.
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-31431
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible System Binary Backdoor
id: a806d611-ea81-4d8a-9b9b-fbf5b6ec520a
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof.
    Adversaries may replace these utilities with backdoored versions to hide malicious activity, harvest credentials, or maintain persistence while appearing to use legitimate system tools.
    This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime max(_time) as lastTime

    from datamodel=Endpoint.Filesystem where

    Filesystem.file_path IN (
        "/usr/bin/cat",
        "/usr/bin/cp",
        "/usr/bin/ls",
        "/usr/bin/lsof",
        "/usr/bin/mv",
        "/usr/bin/netstat",
        "/usr/bin/ps",
        "/usr/bin/ss"
    )

    by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest
       Filesystem.action Filesystem.process_guid Filesystem.process_id

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_system_binary_backdoor_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible System Binary Backdoor activity observed on [$dest$]. System binary [$file_name$] was created or overwritten by [$user$].
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Post-Exploitation
    - Linux Persistence Techniques
    - Linux Privilege Escalation
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1036
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '19656.34275'
title: LSA Authentication Packages Registry Key Modified
description: 'Adversaries can use the autostart mechanism provided by Local Security
  Authority (LSA) authentication packages for persistence or privilege escalation
  by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\.
  The binary will then be executed by the system when the authentication packages
  are loaded. This use case detects modifications to registry values involving LSA
  authentication package configurations. -- Software Association: Cactus -- Atomics
  T1547.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(reg) TERM(add) ("HKLM" OR "HKEY_LOCAL_MACHINE")
  ("lsa" "Authentication Packages") | table _time, host, user, parent_process*, process,
  process_*, signature_id, user_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
technique_id:
- T1547.002
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.crysys.hu/publications/files/skywiper.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.002/T1547.002.md#atomic-test-1---authentication-package

name: M365 Copilot Impersonation Jailbreak Attack
id: cc26aba8-7f4a-4078-b91a-052d6a53cb13
version: 6
creation_date: '2025-10-13'
modification_date: '2026-06-04'
author: Rod Soto
status: experimental
type: TTP
description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks.
data_source:
    - M365 Exported eDiscovery Prompts
search: |-
    `m365_exported_ediscovery_prompt_logs`
      | search Subject_Title="*Pretend you are*" OR Subject_Title="*act as*" OR Subject_Title="*you are now*" OR Subject_Title="*amoral*" OR Subject_Title="*being*" OR Subject_Title="*roleplay as*" OR Subject_Title="*imagine you are*" OR Subject_Title="*behave like*"
      | eval user = Sender
      | eval impersonation_type=case(match(Subject_Title, "(?i)pretend you are.*AI"), "AI_Impersonation", match(Subject_Title, "(?i)(act as|roleplay as).*AI"), "AI_Roleplay", match(Subject_Title, "(?i)amoral.*AI"), "Amoral_AI", match(Subject_Title, "(?i)transcendent being"), "Fictional_Entity", match(Subject_Title, "(?i)(act as|pretend you are).*(entities|multiple)"), "Multi_Entity", match(Subject_Title, "(?i)(imagine you are|behave like).*AI"), "AI_Behavioral_Change", match(Subject_Title, "(?i)you are now.*AI"), "AI_Identity_Override", match(Subject_Title, "(?i)(evil|malicious|harmful).*AI"), "Malicious_AI_Persona", match(Subject_Title, "(?i)(unrestricted|unlimited|uncensored).*AI"), "Unrestricted_AI_Persona", 1=1, "Generic_Roleplay")
      | table _time, user, Subject_Title, impersonation_type, Workload
      | sort -_time
      | `m365_copilot_impersonation_jailbreak_attack_filter`
how_to_implement: To export M365 Copilot prompt logs, navigate to the Microsoft Purview compliance portal (compliance.microsoft.com) and access eDiscovery. Create a new eDiscovery case, add target user accounts or date ranges as data sources, then create a search query targeting M365 Copilot interactions across relevant workloads. Once the search completes, export the results to generate a package containing prompt logs with fields like Subject_Title (prompt text), Sender, timestamps, and workload metadata. Download the exported files using the eDiscovery Export Tool and ingest them into Splunk for security analysis and detection of jailbreak attempts, data exfiltration requests, and policy violations.
known_false_positives: Legitimate creative writers developing fictional characters, game developers creating roleplay scenarios, educators teaching about AI ethics and limitations, researchers studying AI behavior, or users engaging in harmless creative storytelling may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
finding:
    title: User $user$ attempted M365 Copilot impersonation jailbreak with impersonation type $impersonation_type$, trying to manipulate the AI into adopting alternate personas or unrestricted behaviors that could bypass safety controls and violate acceptable use policies.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Proxy
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '36445.64009'
title: masscan Execution - Windows
description: Masscan is a high-performance, open-source network scanning tool designed
  to scan large ranges of IP addresses for open ports, offering similar functionality
  to Nmap but with significantly faster scanning capabilities. Threat actors may use
  port and vulnerability scanning tools to identify running services and potential
  exploits on remote hosts and network devices. This use case detects masscan executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(masscan) OR "masscan.exe") | regex process_name="(?i)masscan\.exe"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows event logs
references:
- https://github.com/robertdavidgraham/masscan/tree/master
- https://attack.mitre.org/techniques/T1046/
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
- https://www.kali.org/tools/masscan/

id: '11280.15742'
title: Microsoft Diagnostic Tool "DogWalk" Package Path Traversal
description: The vulnerability lies in the Microsoft Diagnostic Tool's sdiageng.dll
  library, which takes the attacker-supplied folder path from the package configuration
  XML file inside the diagcab archive, and copies all files from that folder to a
  local temporary folder. During this process, it enumerates files in attacker's folder,
  gets the file name for each of them, then glues together the local temporary path
  and that file name to generate the local path on the computer where the file is
  to be created.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("msdt.exe" OR TERM(msdt)) AND ("/cab" OR ".diagcab")
  | table _time, host, user process, process_*, parent_*, signature_id, trun_cmd |
  bin span=1s | stats values(*) as * by _time, host | where match(process, "(?i)cab|diagcab") '
techniques:
- execution:user execution
technique_id: 
- T1204
data_category:
- Windows event logs
references:
- https://blog.0patch.com/2022/06/microsoft-diagnostic-tools-dogwalk.html

name: Mmc LOLBAS Execution Process Spawn
id: f6601940-4c74-11ec-b9b7-3e22fbd008af
version: 13
creation_date: '2021-11-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `mmc.exe` is the parent process. This activity is significant because adversaries can abuse the DCOM protocol and MMC20 COM object to execute malicious code, using Windows native binaries documented by the LOLBAS project. If confirmed malicious, this behavior could indicate lateral movement, allowing attackers to execute code remotely, potentially leading to further compromise and persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
    where (Processes.parent_process_name=mmc.exe) (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
    "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Dllhost.exe", "Pnputil.exe", "Atbroker.exe",
    "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe",
    "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe",
    "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe",
    "SettingSyncHost.exe", "Cmstp.exe", "Mmc.exe", "Stordiag.exe", "Scriptrunner.exe",
    "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe",
    "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe",
    "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe",
    "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe",
    "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe"))

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
    Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
    Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
    Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
    Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `mmc_lolbas_execution_process_spawn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1021/003/
    - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
    - https://lolbas-project.github.io/
finding:
    title: Mmc.exe spawned a LOLBAS process on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
    - Living Off The Land
    - Water Gamayun
    - XML Runner Loader
asset_type: Endpoint
mitre_attack_id:
    - T1021.003
    - T1218.014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20685.36866'
title: ngrok Execution - Windows
description: 'Ngrok is a legitimate reverse proxy tool that can create a secure tunnel
  to servers located behind firewalls or on local machines that do not have a public
  IP. Ngrok has been leveraged by threat actors in several campaigns including use
  for lateral movement and data exfiltration. This use case detects process creation
  events for ngrok.exe or command patterns likely to be unique to ngrok in the event
  of a renamed executable. -- Threat Actor Association: Scattered Spider (aka. Muddled
  Libra, Scatter Swine, Starfraud, UNC3944)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(ngrok) OR (TERM(start) "--all" "--config" ".yml") OR (TERM(tcp) ("139" OR "445"
  OR "3389" OR "5985" OR "5986")) | where match(process, "(?i)(tcp\s+(139|445|3389|5985|5986))|(\.exe\s+|(authtoken\s|start\s+--all))|(start\s.*\s--all\s.*\s--config\s.+\.yml)")
  OR match(process_path, "(?i)ngrok\.exe") | table _time, host, user, signature_id,
  process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:protocol tunneling
technique_id: 
- T1572
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.logpoint.com/en/blog/a-deep-look-at-the-darkside-ransomware-operators-and-their-affiliates/

id: '22594.40765'
title: Potential Sysinternals Tool Execution
description: 'Sysinternals is a widely-used set of utilities for endpoint management,
  troubleshooting, and monitoring and is available for free from Microsoft. While
  not installed by default, it can be considered a LOLBAS due to its ubiquity in enterprise
  environments. Threat actors can abuse these utilities in a variety of ways including
  information gathering, remote command execution, memory dumping, and many more.
  This use case detects command line executions including the accepteula flag. The
  names of individual SysInternal tools have not been included to account for instances
  where the process has been renamed. Allowlisting by process path for known benign
  executables using -accepteula or /accepteula combined with usernames expected to
  use Sysinternals is recommended to reduce false positives. -- Threat Actor Association:
  Cluster Alpha (STAC1248) - Software Association: Fog -- LOLBINS/LOLBAS'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "-accepteula" OR "/accepteula" | regex process="(?i)\s(-|\/)accepteula" | table
  _time, host, user host, process, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/sysinternals/

id: '5471.5637'
title: Rubeus Password Change
description: The changepw module will take a user's TGT .kirbi blog and execute a
  MS kpasswd password change with the specified /new:PASSWORD value. If a /dc is not
  specified, the computer's current domain controller is extracted and used as the
  destination for the password reset traffic. This is the Aorato Kerberos password
  reset disclosed in 2014, and is equivalent to Kekeo's misc::changepw function.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4738) OR
  "<EventID>4738<") TERM(ANONYMOUS) TERM(LOGON) ) OR (TERM(EventCode=4723) OR "<EventID>4723<")
  | eval user=mvappend(coi_user, user) | table _time, host, user, signature_id, session_id,
  signature | bin span=5s | stats values(*) as * by _time, host | where match(signature_id,
  "4738") AND match(signature_id, "4723") '
techniques:
- persistence:valid accounts
- privilege-escalation:valid accounts
- defense-evasion:valid accounts
- credential-access:steal or forge kerberos tickets
technique_id: 
- T1078
- T1558
data_category:
- Windows event logs
references:
- https://github.com/GhostPack/Rubeus/blob/master/Rubeus/Commands/Changepw.cs

name: Windows AppLocker Privilege Escalation via Unauthorized Bypass
id: bca48629-7fa2-40d3-9e5d-807564504e28
version: 9
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This analytic is designed to identify attempts to bypass these restrictions, which could be indicative of an attacker attempting to escalate privileges. The analytic uses EventCodes 8007, 8004, 8022, 8025, 8029, and 8040 to identify these attempts. The analytic will identify the host, full file path, and target user associated with the bypass attempt. These EventCodes are related to block events and focus on 5 attempts or more.
data_source: []
search: |-
    `applocker` EventCode IN (8007, 8004, 8022, 8025, 8029, 8040)
      | spath input=UserData_Xml
      | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
      | stats count AS attempt_count min(_time) as firstTime max(_time) as lastTime
        BY dest, PolicyName, RuleId,
           user, TargetProcessId, FilePath,
           FullFilePath, EventCode
      | where attempt_count > 5
      | sort - attempt_count
      | lookup applockereventcodes EventCode OUTPUT Description
      | `windows_applocker_privilege_escalation_via_unauthorized_bypass_filter`
how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk.
known_false_positives: False positives are possible if legitimate users are attempting to bypass application restrictions. This could occur if a user is attempting to run an application that is not permitted by AppLocker. It is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. Modify the threshold as needed to reduce false positives.
references:
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/querying-application-control-events-centrally-using-advanced-hunting
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
finding:
    title: An attempt to bypass application restrictions was detected on a host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows AppLocker
asset_type: Endpoint
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Define Win Defender Threat Action
id: 7215831c-8252-4ae3-8d43-db588e82f952
version: 11
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows Defender ThreatSeverityDefaultAction registry setting. It leverages data from the Endpoint.Registry datamodel to identify changes in registry values that define how Windows Defender responds to threats. This activity is significant because altering these settings can impair the system's defense mechanisms, potentially allowing threats to go unaddressed. If confirmed malicious, this could enable attackers to bypass antivirus protections, leading to persistent threats and increased risk of data compromise or further system exploitation.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Threats\\ThreatSeverityDefaultAction*" Registry.registry_value_data IN ("0x00000001", "9") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_define_win_defender_threat_action_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Define Windows Defender threat action through registry on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry EnableLinkedConnections
id: 93048164-3358-4af0-8680-aa5f38440516
version: 12
creation_date: '2023-07-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious modification to the Windows registry setting for EnableLinkedConnections. It leverages data from the Endpoint.Registry datamodel to identify changes where the registry path is "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" and the value is set to "0x00000001". This activity is significant because enabling linked connections can allow network shares to be accessed with both standard and administrator-level privileges, a technique often abused by malware like BlackByte ransomware. If confirmed malicious, this could lead to unauthorized access to sensitive network resources, escalating the attacker's privileges.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
finding:
    title: A registry modification in Windows EnableLinkedConnections configuration on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - BlackByte Ransomware
asset_type: Endpoint
atomic_guid:
    - 4f4e2f9f-6209-4fcf-9b15-3b7455706f5b
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows New Default File Association Value Set
id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a
version: 5
creation_date: '2021-09-28'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects registry changes to the default file association value. It leverages data from the Endpoint data model, specifically monitoring registry paths under "HKCR\\*\\shell\\open\\command\\*". This activity can be significant because, attackers might alter the default file associations in order to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_new_default_file_association_value_set_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: Windows and third party software will create and modify these file associations during installation or upgrades. Additional filters needs to be applied to tune environment specific false positives.
references:
    - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
analytic_story:
    - Hermetic Wiper
    - Windows Registry Abuse
    - Prestige Ransomware
    - Windows Privilege Escalation
    - Windows Persistence Techniques
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1546.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Desktop Network Bruteforce Attempt
id: 908bf0d5-0983-4afd-b6a4-e9eb5d361a7d
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Jose Hernandez, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity. This query detects potential RDP brute force attacks by identifying source IPs that have made more than 10 connection attempts to the same RDP port on a host within a one-hour window. The results are presented in a table that includes the source and destination IPs, destination port, number of attempts, and the times of the first and last connection attempts, helping to prioritize IPs based on the intensity of activity.
data_source:
    - Sysmon EventID 3
    - Cisco Secure Access Firewall
search: |-
    | tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime values(Al_Traffic.src_port) as src_port FROM datamodel=Network_Traffic
      WHERE (
            All_Traffic.app=rdp
            OR
            All_Traffic.dest_port=3389
        )
      BY All_Traffic.action All_Traffic.app All_Traffic.dest
         All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction
         All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version
         All_Traffic.src All_Traffic.src_ip All_Traffic.transport
         All_Traffic.user All_Traffic.vendor_product
    | `drop_dm_object_name("All_Traffic")`
    | eval duration=lastTime-firstTime
    | where count > 10 AND duration < 3600
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_remote_desktop_network_bruteforce_attempt_filter`
how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model. Adjust the count and duration thresholds as necessary to tune the sensitivity of your detection.
known_false_positives: RDP gateways may have unusually high amounts of traffic from all other hosts' RDP applications in the network.Any legitimate RDP traffic using wrong/expired credentials will be also detected as a false positive.
references:
    - https://www.zscaler.com/blogs/security-research/ransomware-delivered-using-rdp-brute-force-attack
    - https://www.reliaquest.com/blog/rdp-brute-force-attacks/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $dest$ may be the target of an RDP Bruteforce from $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - SamSam Ransomware
    - Ryuk Ransomware
    - Compromised User Account
    - Windows RDP Artifacts and Defense Evasion
    - Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1110.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network