Splunk rules: 2a

name: AWS Defense Evasion Stop Logging Cloudtrail
id: 8a2f3ca2-4eb5-4389-a549-14063882e537
version: 12
creation_date: '2022-07-12'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects `StopLogging` events in AWS CloudTrail logs. It leverages CloudTrail event data to identify when logging is intentionally stopped, excluding console-based actions and focusing on successful attempts. This activity is significant because adversaries may stop logging to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to perform further activities without being logged, hindering incident response and forensic investigations, and potentially leading to unauthorized access or data exfiltration.
data_source:
    - AWS CloudTrail StopLogging
search: |-
    `cloudtrail` eventName = StopLogging eventSource = cloudtrail.amazonaws.com userAgent!=console.amazonaws.com errorCode = success
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_defense_evasion_stop_logging_cloudtrail_filter`
how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity.
references:
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: User $user$ has stopped Cloudtrail logging for account id $vendor_account$ from IP $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '39961.72279'
title: Cipher.exe Execution
description: Cipher.exe is a Windows command-line utility used for managing encryption
  on NTFS drives and securely overwriting data to prevent recovery. Threat actors
  may destroy data on specific systems or across a network to disrupt the availability
  of systems, services, or resources. This often involves overwriting files or data
  on local and remote drives, rendering the information irrecoverable. Unlike basic
  file deletion commands (e.g., del or rm), which typically remove file pointers but
  leave data recoverable through forensic techniques, this method ensures complete
  data loss by overwriting the content. Threat actors may overwrite files and directories
  with random data or other content to prevent recovery and obscure their activity.
  This tactic targets individual files rather than wiping entire disk sections or
  logical structures. This use case detects the execution of cipher.exe with the /w
  flag, accounting for instances where the binary has been renamed. Executions of
  processes using arguments with the pattern " /w:" followed by non-numeric characters
  should be allowlisted to reduce false positives.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "cipher.exe" OR TERM(cipher) | regex process_path="(?i)\x5ccipher\.exe"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- impact:data destruction
technique_id: 
- T1485
data_category:
- Windows event logs
references:
- https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/use-cipher-to-overwrite-deleted-data

name: Cisco IOS XE Tunnel Interface Configuration
id: 8654314d-8e4d-4971-9f35-b9d477bf668e
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. The Salt Typhoon notes identify this tunnel configuration pattern as suspicious.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("HA_EM", "PARSER")
    mnemonic IN ("LOG", "CFGLOG_LOGGEDCMD")
    message_text IN ("*interface Tunnel*", "*tunnel source*", "*tunnel destination*", "*ip address 10.10.12.*")
    | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
    | rex field=message_text "<enteredCommand><cli>(?<parser_command>.*?)</cli>"
    | rex field=message_text "<user>(?<parser_user>[^<]+)</user>"
    | rex field=message_text "<srcIP>(?<parser_src_ip>[^<]+)</srcIP>"
    | eval command=lower(trim(coalesce(parser_command, eem_command, "")))
    | eval event_type=case(
        match(command, "^interface\s+tunnel"), "interface_tunnel",
        match(command, "^tunnel\s+source"), "tunnel_source",
        match(command, "^tunnel\s+destination"), "tunnel_destination",
        match(command, "^ip\s+address\s+10\.10\.12\."), "tunnel_ip_address",
        true(), null())
    | where isnotnull(event_type)
    | eval user=coalesce(parser_user, user, "unknown")
    | eval src_ip=coalesce(parser_src_ip, src_ip, "unknown")
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | bin _time span=15m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(event_type) as event_types
                  values(user) as user
                  values(src_ip) as src_ip
                  values(command) as commands
      by _time dest
    | where mvfind(event_types, "interface_tunnel") >= 0
            AND
            mvfind(event_types, "tunnel_source") >= 0
            AND
            mvfind(event_types, "tunnel_destination") >= 0
            AND
            mvfind(event_types, "tunnel_ip_address") >= 0
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_tunnel_interface_configuration_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cisco IOS-XE tunnel interface configuration matching Salt Typhoon notes was observed on $dest$ by $user$.
threat_objects:
    - field: commands
      type: command
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1572
    - T1090
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity
id: 2f3862c6-45ff-4a02-9bd4-7e25c209fcd9
version: 3
creation_date: '2026-03-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager.
    It leverages the "serviceproxy_access.log" and identifies source-host combinations that perform all key stages of the exploitation as reported in public POCs in a short period: authentication/config collection (`.dca`), upload actions (`uploadAck`), and payload-style access (`.gz/*`).
    The behavior can indicate attempted exploitation activity associated with Cisco Catalyst SD-WAN Manager vulnerabilities CVE-2026-20122 (Arbitrary File Overwrite) and CVE-2026-20128 (Information Disclosure).
data_source:
    - Cisco SD-WAN Service Proxy Access Logs
search: |-
    `cisco_sd_wan_service_proxy_access`
    | rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
    | rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
    | eval
        http_response_code = tonumber(http_response_code),
        bytes_in           = tonumber(bytes_in),
        bytes_out          = tonumber(bytes_out),
        duration           = tonumber(duration),
        upstream_service_time = if(upstream_service_time="-", null(), tonumber(upstream_service_time)),
        status             = http_response_code,
        bytes              = bytes_in + bytes_out,
        http_user_agent_length = len(http_user_agent)

    | search (
            (   http_method="POST"
                uri IN (
                    "*/dataservice/smartLicensing/uploadAck*"
                )
            )
            OR (
                http_method="GET"
                uri="*/reports/data/opt/data/containers/config/data-collection-agent/.dca*"
                )
            OR (uri="*.gz/*")
    )

    | eval uri_sequence_steps = case(
            match(uri, ".*/\.dca"),       "auth",
            match(uri, ".*/uploadAck"),   "upload",
            match(uri, ".*\.gz/.*"),      "payload",
            true(),                       "other"
    )

    | bin _time span=1m
    | stats
        dc(uri_sequence_steps)        as unique_uri_sequence_steps
        values(uri)                   as uri
        values(http_method)           as http_method
        values(http_user_agent)       as http_user_agent
        min(_time)                    as firstTime
        max(_time)                    as lastTime
    by src dest _time

    | where unique_uri_sequence_steps >= 3
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | sort 0 - firstTime
    | `cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter`
how_to_implement: |
    This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk.
    These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
    - https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE
finding:
    title: Cisco SD-WAN Manager exploitation activity from $src$ has been identified targeting host $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
    - CVE-2026-20122
    - CVE-2026-20128
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Curl Execution with Percent Encoded URL
id: 9a8d5516-4c5e-11ef-9d42-acde48001122
version: 5
creation_date: '2026-03-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output).
    It leverages process execution telemetry from Endpoint Detection and Response (EDR) data sources to identify curl commands that may be using URL encoding to obfuscate download locations or payload paths.
    This behavior is notable because percent-encoded URLs are commonly used by adversaries to evade simple string-based detections, hide malicious infrastructure, or bypass network security controls.
    When combined with file download behavior, this activity may indicate malware staging, payload retrieval, or secondary tool deployment.
    Analysts should review the decoded URL, destination host, parent process, and downloaded file to determine whether the activity is authorized or malicious.
    The analytic calculates the number of percent (%) characters in the curl command line and triggers when a threshold of three or more is met, indicating potential URL encoding.
    Adjust the threshold as needed based on your environment and tuning requirements.
data_source:
    - CrowdStrike ProcessRollup2
    - Sysmon EventID 1
    - Sysmon for Linux EventID 1
    - Windows Event Log Security 4688
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    (
      Processes.process_name IN ("curl.exe", "curl")
      OR
      Processes.original_file_name="curl.exe"
    )
    Processes.process IN (
      "* --output *",
      "* -o *"
    )
    Processes.process IN ("*%*")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`

    ```
      Count the number of % characters in the process command line.
      Change this threshold based on your environment and tuning needs.
    ```
    | eval percent_count = mvcount(split(process, "%")) - 1
    | where percent_count >= 3

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `curl_execution_with_percent_encoded_url_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://github.com/nasbench/Misc-Research/blob/main/LOLBINs/Curl.md
    - https://attack.mitre.org/techniques/T1027/
    - https://attack.mitre.org/techniques/T1105/
    - https://curl.se/docs/manpage.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ with URL-encoded parameters $process$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ with URL-encoded parameters $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - Ingress Tool Transfer
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1027
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Empire with PowerShell Script Block Logging
id: bc1dc6b8-c954-11eb-bade-acde48001122
version: 14
creation_date: '2021-06-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving `system.net.webclient` and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_empire_with_powershell_script_block_logging_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
references:
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://github.com/BC-SECURITY/Empire
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
finding:
    title: The following behavior was identified and typically related to PowerShell-Empire on $dest$ by $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The following behavior was identified and typically related to PowerShell-Empire on $dest$ by $user_id$.
analytic_story:
    - Hellcat Ransomware
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35367.62270'
title: Expand.exe Execution
description: expand.exe is a legitimate Windows utility used to extract files from
  compressed .cab archives. Threat actors have been observed abusing expand.exe to
  unpack malicious payloads hidden within .cab files on compromised systems. This
  use case detects expand.exe executions with .cab file extensions or references to
  suspicious path locations. Allowlisting expected processes with full file paths
  and command lines where possible is recommended for best fidelity. Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "expand.exe" (".cab"
  OR "/F:" OR "-F:" OR "\\ProgramData" OR "\\Public" OR "\\AppData\\Local\\Temp\\"
  OR "\\AppData\\Roaming\\Temp\\") | where match(process, "(?i)\.cab|(-|\/)F:|\x5cAppData\x5c|(Local|Roaming)\x5cTemp\x5c")
  and not match(process, "(?i):\x5cProgramData\x5cDell\x5cUpdateService\x5cTemp\x5c")
  | table _time, host, user, process, process_name, parent_process_path, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:hide artifacts:ntfs file attributes
technique_id:
- T1105
- T1564.004
data_category:
- PowerShell logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Expand/
- https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml
- https://www.threatdown.com/blog/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
- https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/

name: GetAdGroup with PowerShell
id: 872e3063-0fc4-4e68-b2f3-f2b99184a708
version: 9
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with the `Get-AdGroup` commandlet, which is used to query domain groups in a Windows Domain. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is crucial as it may indicate an adversary or Red Team enumerating domain groups for situational awareness and Active Directory discovery. If confirmed malicious, this activity could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-AdGroup*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getadgroup_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GetNetTcpconnection with PowerShell Script Block
id: 091712ff-b02a-4d43-82ed-34765515d95d
version: 10
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet lists network connections on a system, which adversaries may use for situational awareness and Active Directory discovery. Monitoring this activity is crucial as it can indicate reconnaissance efforts by an attacker. If confirmed malicious, this behavior could allow an attacker to map the network, identify critical systems, and plan further attacks, potentially leading to data exfiltration or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `getnettcpconnection_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1049/
    - https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1049
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Hunting 3CXDesktopApp Software
id: 553d0429-1a1c-44bf-b3f5-a8513deb9ee5
version: 9
creation_date: '2023-03-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the presence of any version of the 3CXDesktopApp, also known as the 3CX Desktop App, on Mac or Windows systems. It leverages the Endpoint data model's Processes node to identify instances of the application running, although it does not provide file version information. This activity is significant because 3CX has identified vulnerabilities in versions 18.12.407 and 18.12.416, which could be exploited by attackers. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the affected systems.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=3CXDesktopApp.exe
        OR
        Processes.process_name="3CX Desktop App"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `hunting_3cxdesktopapp_software_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
references:
    - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
    - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
    - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
    - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
    - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
analytic_story:
    - 3CX Supply Chain Attack
asset_type: Endpoint
cve:
    - CVE-2023-29059
mitre_attack_id:
    - T1195.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Kernel Module Using Rmmod Utility
id: 31810b7a-0abe-42be-a210-0dec8106afee
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious use of the `rmmod` utility for kernel module removal, which may indicate an attacker attempt to unload critical or security-related kernel modules. The `rmmod` command is used to remove modules from the Linux kernel, and unauthorized use can be a tactic to disable security features, conceal malicious activities, or disrupt system operations. By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps identify potential tampering with kernel modules, enabling security teams to take proactive measures to protect system integrity and security.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=rmmod
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_kernel_module_using_rmmod_utility_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
finding:
    title: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a Linux kernel module using the rmmod utility.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1547.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Ruby Privilege Escalation
id: 097b28b5-7004-4d40-a715-7e390501788b
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of Ruby commands with elevated privileges on a Linux system. It identifies processes where Ruby is used with the `-e` flag to execute commands via `sudo`, leveraging Endpoint Detection and Response (EDR) telemetry. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access, execute arbitrary commands, and maintain persistent control over the affected system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*ruby*-e*"
        AND
        Processes.process="*exec*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ruby_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/ruby/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1042.1066'
title: New AutoRun Registry Key
description: 'Detects when common autorun scripts in the Windows registry are modified.
  -- Threat Actor Association: APT27/Emissary Panda, APT28, APT29/Nobelium/Cozy Bear,
  APT33, APT37, APT40, APT43, Blind Eagle/APT-C-36, Carbanak, FIN6, FIN7, FIN13, Lazarus,
  MuddyWater, Mustang Panda, NewsPenguin, RedEyes, RomCom, SaintBear (aka UAC-0056,
  UNC2589, TA471), Sandworm Team, TA2541, TA505, UAC-0056, UNC4990 - Software Association:
  ALPHV/BlackCat, Bazarloader, Blackbyte, Havex, LockBit, MirrorBlast, NanoCore, Phosphorus/Magic
  Hound/APT35, Prometheus / Spook, Sodinokibi/REvil, Ransom Cartel, Remcos RAT, Trigona,
  Vice Society, Zloader -- Atomics T1547.001 Test#3 Atomics T1547.001 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` AND EventCode=1 AND ("Windows\\CurrentVersion\\RunOnce"
  OR "Windows\\CurrentVersion\\Run" OR "Windows\\CurrentVersion\\RunServices" OR "Windows\\CurrentVersion\\RunServicesOnce"
  OR "Windows\\CurrentVersion\\RunOnceEx") | table _time, host, user dest, direction,
  dvc, dvc_nt_host, event_id, eventtype, hashes, host, index, parent_process, parent_process_id,
  parent_process_name, parent_process_path, process, process_current_directory, process_id,
  process_name, process_path, signature_id, source, sourcetype, tag, user, user_id
  | bin span=60s | stats values(*) as * by _time, host | rex field=process max_match=0
  (?<registry_path>"[^\"\s]+Windows\\\CurrentVersion\\\Run[^\"\s]{0,}") | eventstats
  values(registry_path) as registry_path by _time dvc '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Windows Sysmon
references: null

name: Possible Lateral Movement PowerShell Spawn
id: cb909b3e-512b-11ec-aa31-3e22fbd008af
version: 17
creation_date: '2021-11-29'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions.
    This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries.
    If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
    count min(_time) as firstTime
          max(_time) as lastTime
    from datamodel=Endpoint.Processes where

    (
        Processes.parent_process_name IN (
            "mmc.exe",
            "services.exe",
            "wmiprvse.exe",
            "wsmprovhost.exe"
        )
        OR
        (
            Processes.parent_process_name="svchost.exe"
            ```
            We exclude the "Schedule" service from the svchost.exe process. But since there are instances where its not hosted in a dedicated svchost process, we need to the hosting group "netsvcs" too
            ```
            NOT Processes.parent_process IN (
                "*-k netsvcs*",
                "*-s Schedule*",
            )
        )
    )
    AND
    (
        Processes.process_name IN ("powershell.exe", "pwsh.exe")
        OR
        (
            Processes.process_name=cmd.exe
            Processes.process IN (
                "*powershell*",
                "*pwsh*"
            )
        )
    )
    NOT Processes.process IN ("*C:\\Windows\\CCM\\*")

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `possible_lateral_movement_powershell_spawn_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    False positives are expected from legitimate use of WMI or certain services. Apply additoinal filters as needed.
references:
    - https://attack.mitre.org/techniques/T1021/003/
    - https://attack.mitre.org/techniques/T1021/006/
    - https://attack.mitre.org/techniques/T1047/
    - https://attack.mitre.org/techniques/T1053/005/
    - https://attack.mitre.org/techniques/T1543/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A PowerShell process was spawned as a child process of typically abused processes on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Lateral Movement
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
    - Scheduled Tasks
    - CISA AA24-241A
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1021.003
    - T1021.006
    - T1047
    - T1053.005
    - T1059.001
    - T1218.014
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20368.36065'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
  use it as a means to execute various behaviors, such as gathering information for
  Discovery as well as remote Execution of files as part of Lateral Movement. This
  use case detects execution of WMIC commands with the ''/node'' switch, indicating
  potential remote operations or information gathering attempts on network endpoints.
  -- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(wmic) OR "wmic.exe") OR "/node:" | regex
  process="(?i)/node:" | table _time, host, user process, process_*, parent_* | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:windows management instrumentation
technique_id: 
- T1047
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

id: '27224.49777'
title: Rundll32 Suspicious Command Line
description: Threat actors using Gamarue, also referred to as Andromeda or Wauchos,
  have been observed abusing rundll32.exe using unusual strings for DLL names. This
  use case detects rundll32 executions with strings matching unusual patterns. Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") TERM(rundll32) OR "rundll32" | regex process="\x5c\x5c?[-_]{2,}[-_]{2,}[-_]{2,}.+,"|
  table _time, host, user, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/threat-detection-report/threats/gamarue/
- https://redcanary.com/blog/lolbins-abuse/

name: Scheduled Task Creation on Remote Endpoint using At
id: 4be54858-432f-11ec-8209-3e22fbd008af
version: 12
creation_date: '2021-11-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks on remote Windows endpoints using the at.exe command. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events involving at.exe with remote command-line arguments. Identifying this activity is significant for a SOC as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, this activity could lead to unauthorized access, persistence, or execution of malicious code, potentially resulting in data theft or further compromise of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
references:
    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at
    - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
finding:
    title: A Windows Scheduled Task was created on a remote endpoint from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
    - Living Off The Land
    - Scheduled Tasks
    - 0bj3ctivity Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1053.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: SLUI Spawning a Process
id: 879c4330-b3e0-11eb-b1b1-acde48001122
version: 13
creation_date: '2021-05-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the Microsoft Software Licensing User Interface Tool (`slui.exe`) spawning a child process. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where `slui.exe` is the parent process. This activity is significant because `slui.exe` should not typically spawn child processes, and doing so may indicate a UAC bypass attempt, leading to elevated privileges. If confirmed malicious, an attacker could leverage this to execute code with elevated privileges, potentially compromising the system's security and gaining unauthorized access.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=slui.exe AND NOT Processes.process_name=slui.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `slui_spawning_a_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring.
references:
    - https://www.exploit-db.com/exploits/46998
    - https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
finding:
    title: A slui process $parent_process_name$ spawning child process $process_name$ on host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A slui process $parent_process_name$ spawning child process $process_name$ on host $dest$
analytic_story:
    - DarkSide Ransomware
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '28106.51148'
title: Temporary File Executed from Public Folder
description: 'The BlackBerry Threat Research and Intelligence Team has detailed several
  behaviors of threat actors using the RomCom remote access trojan. One indication
  of unusual activity is the placement of binaries in Temp directories with the extension
  .tmp which are launched by processes stored in the Public folder. This use case
  detects processes executing from temporary directories with parent processes located
  in public folders. -- Threat Actor Association: UNC5812'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "\\AppData\\Local\\Temp\\" ".tmp" "\\Users\\Public"
  ".exe" | regex parent_process_path="(?i)\x5cUsers\x5cPublic\x5c\.exe"| regex process_path="(?i)\x5cAppData\x5cLocal\x5cTemp\x5c.+\.tmp"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- lateral-movement:taint shared content
technique_id: 
- T1105
- T1080
data_category:
- Windows event logs
references:
- https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/behavior
- https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries

name: VMware Server Side Template Injection Hunt
id: 5796b570-ad12-44df-b1b5-b7e6ae3aabb0
version: 8
creation_date: '2022-05-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: |
    The following analytic identifies potential server-side template injection attempts related to CVE-2022-22954.
    It detects suspicious URL patterns containing "deviceudid" and keywords like "java.lang.ProcessBuilder" or "freemarker.template.utility.ObjectConstructor" using web or proxy logs within the Web Datamodel.
    This activity is significant as it may indicate an attempt to exploit a known vulnerability in VMware, potentially leading to remote code execution.
    If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise the affected system, posing a severe security risk.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.http_method="GET"
    Web.url="*deviceudid=*"
    Web.url IN (
        "*freemarker.template.utility.ObjectConstructor*",
        "*java.lang.ProcessBuilder*"
    )
    BY Web.http_user_agent Web.status
       Web.http_method Web.url Web.url_length
       Web.src Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `vmware_server_side_template_injection_hunt_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: |
    False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
references:
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
    - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
    - https://github.com/sherlocksecurity/VMware-CVE-2022-22954
    - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
    - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
    - https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433
analytic_story:
    - VMware Server Side Injection and Privilege Escalation
asset_type: Web Server
cve:
    - CVE-2022-22954
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network