Splunk rules: 2b

id: '6143.6640'
title: Adfind Execution
description: 'AdFind is a free command-line query tool that can be used for gathering
  information from Active Directory. This use case looks for process executions of
  Adfind. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT31, BlackMatter,
  Conti, DarkSide, FIN6, FIN7, FIN12, Karakurt, Lazarus, Traveling Spider, Wizard
  Spider, Yanluowang - Software Association: ALPHV/BlackCat, BazarLoader, Conti, Dridex,
  Entropy, Lockbit, Nefilim, Quantum, Sodinokibi/REvil - Atomics T1016 Test #6 Atomics
  T1018 Test#10 Atomics T1018 Test#11 Atomics T1069.002 Test #8 Atomics T1087.002
  Test #5 Atomics T1087.002 Test #6 Atomics T1087.002 Test #7 Atomics T1087.002 Test
  #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process OR TERM(ingress.event.procstart)) "adfind" | table
  _time, host, user user, process, process_*, parent_* | bin span=5s | stats values(*)
  as * by _time, host | where event_count > 0 '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:domain trust discovery
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1087.002
- T1069.002
- T1482
- T1016
- T1018
data_category:
- Windows event logs
references:
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

id: '20033.35681'
title: Advanced IP Scanner Execution
description: 'Advanced IP Scanner is a legitimate utility that can perform network
  scanning. Several threat actors, including UNC2465, Conti, Pysa ransomware and FIN12,
  have been reported to use Advanced IP Scanner during reconnaissance activities.
  -- Threat Actor Association: FIN12, UNC2465 - Software Association: Akira, AvosLocker,
  Conti, Pysa'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) "advanced_ip_scanner" OR (TERM(/portable) TERM(/lng)) | where match(process_name,
  "(?i)advanced_ip_scanner") OR match(process, "(?i)\sportable/s.+\slng") | table
  _time, host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox
- https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-destructive-pysa-ransomware
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
- https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/
- https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations

name: AWS ECR Container Scanning Findings High
id: 30a0e9f8-f1dd-4f9d-8fc2-c622461d781c
version: 13
creation_date: '2021-08-18'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies high-severity findings from AWS Elastic Container Registry (ECR) image scans. It detects these activities by analyzing AWS CloudTrail logs for the DescribeImageScanFindings event, specifically filtering for findings with a high severity level. This activity is significant for a SOC because high-severity vulnerabilities in container images can lead to potential exploitation if not addressed. If confirmed malicious, attackers could exploit these vulnerabilities to gain unauthorized access, execute arbitrary code, or escalate privileges within the container environment, posing a significant risk to the overall security posture.
data_source:
    - AWS CloudTrail DescribeImageScanFindings
search: |-
    `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
      | spath path=responseElements.imageScanFindings.findings{} output=findings
      | mvexpand findings
      | spath input=findings
      | search severity=HIGH
      | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product finding_name
           finding_description imageDigest repository
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_ecr_container_scanning_findings_high_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
finding:
    title: Vulnerabilities with severity high found in repository $repository$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: AWS New MFA Method Registered For User
id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b
version: 12
creation_date: '2023-01-31'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS account. It leverages AWS CloudTrail logs to identify the `CreateVirtualMFADevice` event. This activity is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to secure their access, making it difficult to detect and remove their presence, potentially leading to further unauthorized activities and data breaches.
data_source:
    - AWS CloudTrail CreateVirtualMFADevice
search: |-
    `cloudtrail` eventName=CreateVirtualMFADevice
      | rename userName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_new_mfa_method_registered_for_user_filter`
how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs.
known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
references:
    - https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
    - https://attack.mitre.org/techniques/T1556/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://twitter.com/jhencinski/status/1618660062352007174
finding:
    title: A new virtual device is added to user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: AWS Unusual Number of Failed Authentications From Ip
id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
version: 15
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies a single source IP failing to authenticate into the AWS Console with multiple valid users. It uses CloudTrail logs and calculates the standard deviation for source IP, leveraging the 3-sigma rule to detect unusual numbers of failed authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName=ConsoleLogin action=failure
      | rename eventName as action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region
      | bucket span=10m _time
      | stats  dc(_raw) AS distinct_attempts values(user_name) as tried_accounts values(action) as action values(dest) as dest values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(vendor_product) as vendor_product values(user_agent) as user_agent
        BY _time, src
      | eventstats avg(distinct_attempts) as avg_attempts , stdev(distinct_attempts) as ip_std
        BY _time
      | eval upperBound=(avg_attempts+ip_std*3)
      | eval  isOutlier=if(distinct_attempts > 10 and distinct_attempts >= upperBound, 1, 0)
      | where isOutlier = 1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_unusual_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment
known_false_positives: No known false postives for this detection. Please review this alert
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
    - https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
intermediate_findings:
    entities:
        - field: tried_accounts
          type: user
          score: 20
          message: 'Unusual number of failed console login attempts (Count: $distinct_attempts$) against users from IP Address - $src$'
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Detect New Open S3 buckets
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
version: 11
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of open/public S3 buckets in AWS. It detects this activity by analyzing AWS CloudTrail events for `PutBucketAcl` actions where the access control list (ACL) grants permissions to all users or authenticated users. This activity is significant because open S3 buckets can expose sensitive data to unauthorized access, leading to data breaches. If confirmed malicious, an attacker could read, write, or fully control the contents of the bucket, potentially leading to data exfiltration or tampering.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl
      | rex field=_raw "(?<json_field>{.+})"
      | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
      | search grantees=*
      | mvexpand grantees
      | spath input=grantees output=uri path=Grantee.URI
      | spath input=grantees output=permission path=Permission
      | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
      | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL")
      | rename requestParameters.bucketName AS bucketName
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY user_arn userIdentity.principalId userAgent
           uri permission bucketName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_new_open_s3_buckets_filter`
how_to_implement: You must install the AWS App for Splunk.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
references: []
finding:
    title: User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
    entity:
        field: user_arn
        type: user
        score: 50
analytic_story:
    - Suspicious AWS S3 Activities
asset_type: S3 Bucket
mitre_attack_id:
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: High Frequency Copy Of Files In Network Share
id: 40925f12-4709-11ec-bb43-acde48001122
version: 11
creation_date: '2021-11-17'
modification_date: '2026-08-05'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts.
    It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares.
    This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering.
    If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
data_source:
    - Windows Event Log Security 5145
search: |-
    `wineventlog_security`
    EventCode=5145
    RelativeTargetName IN (
        "*.7z", "*.bmp", "*.db", "*.doc", "*.docx",
        "*.gif", "*.gz", "*.jpg", "*.key", "*.log",
        "*.pdf", "*.png", "*.ppt", "*.pptx", "*.rar",
        "*.rtf", "*.tar", "*.txt", "*.xls", "*.xlsx", "*.zip"
    )
    ObjectType=File
    ShareName IN (
        "\\\\*\\Admin$",
        "\\\\*\\C$",
        "\\\\*\\IPC$"
    )
    | eval AccessMask_ = tonumber(AccessMask, 16)

    ```
    We Select only write-related operations:
        0x2 = WriteData (create/write file)
        0x4 = AppendData (append to file)
    ```

    | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)

    | bucket _time span=5m

    ```
    Count write events per host, user and source IP within each time window
    ```
    | stats
        values(RelativeTargetName) AS valRelativeTargetName
        values(ShareName) AS valShareName
        values(ObjectType) AS valObjectType
        values(AccessMask) AS valAccessMask
        values(src_port) AS valSrcPort
        values(SourceAddress) AS valSrcAddress
        count AS numFileWriteEvents
    BY dest _time EventCode src_user src_ip


    ```
    Build a historical baseline for each destination host and user
    using the average and standard deviation of previous buckets
    ```

    | eventstats
        avg(numFileWriteEvents) AS avgFileWriteEvents
        stdev(numFileWriteEvents) AS stdFileWriteEvents
        count AS numSlots
    BY dest EventCode src_user

    | eval upperThreshold=avgFileWriteEvents + (stdFileWriteEvents * 3)
    | eval isOutlier=if(
        numFileWriteEvents > 20
        AND (
            numSlots < 5
            OR numFileWriteEvents >= upperThreshold
        ),
        1,
        0
    )
    | where isOutlier=1
    | `high_frequency_copy_of_files_in_network_share_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
known_false_positives: |-
    This behavior may be seen in normal transfer of files within a network if network shares are commonly used for sharing documents.
references:
    - https://attack.mitre.org/techniques/T1537/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: High frequency copy of file [$valRelativeTargetName$] into a network share from [$src_ip$] by [$src_user$]
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Information Sabotage
    - Insider Threat
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux DD File Overwrite
id: 9b6aae5e-8d85-11ec-b2ae-acde48001122
version: 10
creation_date: '2022-02-15'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery difficult and potentially causing significant operational disruptions.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "dd"
        AND
        Processes.process = "*of=*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_dd_file_overwrite_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://gtfobins.github.io/gtfobins/dd/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
finding:
    title: A commandline $process$ executed on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Pedit Offset Out Of Bounds
id: 749d9bbf-cfa5-42d0-90e0-eb9300f7750a
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following detects a Linux kernel warning message containing "tc action pedit offset" and "out of bounds" logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred.
data_source:
    - Linux Messages Syslog
search: >-
    `linux_syslog` "*tc action pedit offset*" "*out of bounds*"
    | rename host as dest
    | stats count min(_time) as firstTime max(_time) as lastTime by dest _raw
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_pedit_offset_out_of_bounds_filter`
how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833).
known_false_positives: This is generated only when the kernel's act_pedit module encounters a write outside the writable SKB region. This never occurs in normal tc pedit usage.
references:
    - https://tuxcare.com/blog/pedit-cow-cve/
    - https://github.com/sgkdev/packet_edit_meme
finding:
    title: Out-of-bounds write by act_pedit on $dest$ indicating possible privilege escalation.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-46331
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft Intune Manual Device Management
id: 5ca7ebee-4ee7-4cf2-b3be-0ea26a00d822
version: 4
creation_date: '2025-01-06'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: Hunting
description: >-
    Microsoft Intune device management configuration policies, scripts & apps are a all tools administrators can use to remotely manage intune managed devices.
    Instead of waiting for the devices to poll for changes to polciies, the policies can be manually pushed to expidite delivery.
    This may be useful in a pinch, it may also be a sign of an impatient attacker trying to speed up the delivery of their payload.
    This detection identifies when a device management configuration policy sync events, on-demand remediation scripts are triggered or when devices are remotely restarted.
data_source:
    - Azure Monitor Activity
search: >-
    `azure_monitor_activity` operationName="*ManagedDevice*"
    | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
    | rex field="operationName" "^(?P<action>\w+)\s"
    | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
    | `microsoft_intune_manual_device_management_filter`
how_to_implement: >-
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
references:
    - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
    - https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
    - https://posts.specterops.io/maestro-9ed71d38d546
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1021.007
    - T1072
    - T1529
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Modify ACL permission To Files Or Folder
id: 7e8458cc-acca-11eb-9e3f-acde48001122
version: 14
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of ACL permissions to files or folders, making them accessible to everyone or to system account. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "cacls.exe," "icacls.exe," and "xcacls.exe" with specific command-line arguments. This activity is significant as it may indicate an adversary attempting to evade ACLs or access protected files. If confirmed malicious, this could allow unauthorized access to sensitive data, potentially leading to data breaches or further system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count
      min(_time) as firstTime
      max(_time) as lastTime
      values(Processes.process) as process
      values(Processes.process_id) as process_id
    from datamodel=Endpoint.Processes where
      Processes.process_name IN ("icacls.exe", "cacls.exe", "xcacls.exe")
      Processes.process IN ("*/grant*", "*/g:*", "*/g *")
      Processes.process IN ("* SYSTEM:*", "* S-1-1-0:*")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `modify_acl_permission_to_files_or_folder_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: administrators may use this command. Filter as needed.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious ACL permission modification on $dest$
analytic_story:
    - Crypto Stealer
    - XMRig
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1222
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '12575.17928'
title: Msxsl Execution
description: 'To support complex operations, the XSL standard includes support for
  embedded scripting in various languages. Adversaries may abuse this functionality
  to execute arbitrary files while potentially bypassing application control. Similar
  to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation
  utility binary (msxsl.exe) and can be installed and used to execute malicious JavaScript
  embedded within local or remote (URL referenced) XSL files. Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN) Atomics T1220 Test #1 Atomics T1220 Test #2 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) ("msxsl.exe") OR ((".xml" ".xsl") OR (".xsl" ".xsl")) | table _time,
  host, user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name, "(?i)msxsl") OR match(process, "(?i)\S+\.x[ms]l\s+.*\.xsl") '
techniques:
- defense-evasion:xsl script processing
technique_id: 
- T1220
data_category:
- Windows Sysmon
references:
- https://medium.com/@threathuntingteam/msxsl-exe-and-wmic-exe-a-way-to-proxy-code-execution-8d524f642b75
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/

id: '20634.36765'
title: ntds.dit Access from Unexpected Location
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case detects processes and parent processes interacting with ntds.dit from unexpected
  locations which may indicate malicious activity. Due to limitations in EDR logging,
  EDR rules will only detect on process path (not parent process path). -- Threat
  Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  UNC5221, UTA0178'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "ntds.dit" ("apache" OR "tomcat" OR "AppData"
  OR "Temp" OR "Public" OR "PerfLogs" OR "Public" OR "Downloads" OR ("Recycle" "Bin")
  OR "SysWOW64" OR "User" OR ("Program" "Files") OR "Debug" OR "fonts" OR "Help" or
  "repair" OR "ProgramData") | regex process="(?i)ntds\.dit"| where match(process_path,
  "(?i)\x5c(apache|tomcat|AppData|Temp|PerfLogs|Public|Downloads|User|ProgramData|Recycle(\s+|\.)Bin|(\x5cWindows\x5c(Debug|fonts|Help|repair|SysWOW64)))\x5c")
  or match(parent_process_path, "(?i)\x5c(apache|tomcat|AppData|Temp|PerfLogs|Public|Downloads|User|ProgramData|Recycle(\s+|\.)Bin|(\x5cWindows\x5c(Debug|fonts|Help|repair|SysWOW64)))\x5c")
  | table _time, host, user, process*, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1

name: O365 Mailbox Folder Read Permission Granted
id: cd15c0a8-470e-4b12-9517-046e4927db30
version: 13
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where read permissions are granted to mailbox folders within an Office 365 environment. It detects this activity by monitoring the `o365_management_activity` data source for the `Set-MailboxFolderPermission` and `Add-MailboxFolderPermission` operations. This behavior is significant as it may indicate unauthorized access or changes to mailbox folder permissions, potentially exposing sensitive email content. If confirmed malicious, an attacker could gain unauthorized access to read email communications, leading to data breaches or information leakage.
data_source:
    - O365 ModifyFolderPermissions
search: |-
    `o365_management_activity`
    Workload=Exchange
    Operation IN ("Set-MailboxFolderPermission", "Add-MailboxFolderPermission")
    | eval isReadRole=if(match(AccessRights,"^(ReadItems|Author|NonEditingAuthor|Owner|PublishingAuthor|Reviewer)$"), "true", "false")
    | search isReadRole="true"
    | rename UserId as user
    | fillnull
    | stats count min(_time) as firstTime max(_time) as lastTime
      by signature dest user src vendor_account
         vendor_product Identity AccessRights
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_mailbox_folder_read_permission_granted_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Mailbox folder permissions may be configured for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/002/
    - https://learn.microsoft.com/en-us/powershell/module/exchange/add-mailboxfolderpermission?view=exchange-ps
    - https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxfolderpermission?view=exchange-ps
finding:
    title: A folder was granted read permission by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: O365 Multi-Source Failed Authentications Spike
id: ea4e2c41-dbfb-4f5f-a7b6-9ac1b7f104aa
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic identifies a spike in failed authentication attempts within an Office 365 environment, indicative of a potential distributed password spraying attack. It leverages UserLoginFailed events from O365 Management Activity logs, focusing on ErrorNumber 50126. This detection is significant as it highlights attempts to bypass security controls using multiple IP addresses and user agents. If confirmed malicious, this activity could lead to unauthorized access, data breaches, privilege escalation, and lateral movement within the organization. Early detection is crucial to prevent account takeovers and mitigate subsequent threats.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed ErrorNumber=50126
      | bucket span=5m _time
      | eval uniqueIPUserCombo = src_ip . "-" . user
      | fillnull
      | stats earliest(_time) as firstTime max(_time) as lastTime dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, values(user) as user, values(src_ip) as ips, values(user_agent) as user_agents values(signature) as signature values(src) as src values(dest) as dest
        BY _time vendor_account vendor_product
      | where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_multi_source_failed_authentications_spike_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
known_false_positives: This detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of VPNs or cloud services that rotate IP addresses. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
analytic_story:
    - Office 365 Account Takeover
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '44542.87313'
title: SimpleHelp Remote Access Tool Service Installation
description: 'Threat actors may install remote access tools (RATs) as Windows services
  to maintain persistent access to compromised systems. Tools like SimpleHelp or JWrapper
  Remote Access are often abused for stealthy remote control, masquerading as legitimate
  IT support tools. This use case detects the installation of Windows services (event
  codes 4697 or 7045) where the service binary path matches known patterns associated
  with SimpleHelp, JWrapper Remote Access, or similarly named executables, indicating
  potential unauthorized remote access setup. - Windows Security event 4697: The minimum
  OS version is Server 2016 or Windows 10. Windows Server event 7045: Windows Server
  2008 R2 and 7, Windows Server 2012 R2 and 8.1, Windows Server 2016 and 10 - LOLRMM'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR
  "<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") "jwrapper" OR "simplehelp"
  OR "simpleservice" OR "simplegatewayservice" OR "remote access" OR "windowslauncher.exe"
  | rex field=_raw "<Data Name=''ServiceFileName''>\"?(?<service_file_path>[^<\"]+)\"?</Data>"|
  where match(service_file_path, "(?i)\x5c(Program\sFiles|ProgramData)\x5c(SimpleHelp|JWrapper-Remote\s(Access|Support))(\x5c.*)?\x5c((simplehelpcustomer|simpleservice|simplegatewayservice|remote\saccess)\.exe|windowslauncher\.exe)$")
  | table _time, host, user, signature_id, service_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:system services
- persistence:create or modify system process
- command-and-control:remote access software
technique_id: 
- T1569.002
- T1543
- T1219
data_category:
- Windows event logs
references:
- https://lolrmm.io/tools/simplehelp
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_remote_access_tools_simple_help/
- https://simple-help.com/downloads

name: Windows Chromium Browser No Security Sandbox Process
id: 314cb263-7eeb-4d45-b693-bb21699c73d2
version: 6
creation_date: '2025-05-28'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |
    The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome's built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process IN ("*--no-sandbox*", "*--allow-no-sandbox-job*")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_browser_no_security_sandbox_process_filter`
how_to_implement: |
    To successfully implement this search you need to be ingesting information
    on process that include the name of the process responsible for the changes from
    your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
    confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
    endpoint product.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive.
references:
    - https://unix.stackexchange.com/questions/68832/what-does-the-chromium-option-no-sandbox-mean
finding:
    title: A chromium process with the --no-sandbox flag was launched on $dest$ by user $user$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Malicious Inno Setup Loader
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Credentials from Web Browsers Saved in TEMP Folder
id: b36b23ea-763c-417b-bd4a-6a378dabad1a
version: 10
creation_date: '2024-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of files containing passwords, cookies, and saved login account information by the Braodo stealer malware in temporary folders. Braodo often collects these credentials from browsers and applications, storing them in temp directories before exfiltration. This detection focuses on monitoring for the creation of files with patterns or formats commonly associated with stolen credentials. By identifying these activities, security teams can take needed action to prevent sensitive login data from being leaked, reducing the risk of unauthorized access to user accounts and systems.
data_source:
    - Sysmon EventID 11
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("login*", "pass*","cookie*","master_key*") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_web_browsers_saved_in_temp_folder_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://x.com/suyog41/status/1825869470323056748
    - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
finding:
    title: A known credential file name - [$file_name$] was saved in %temp% folder of [$dest$].
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Braodo Stealer
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1555.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Default Rdp File Deletion
id: 30a334c1-f9a5-4fbd-8958-5b65a8435cb2
version: 5
creation_date: '2025-08-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies the deletion of the Default.rdp file from a user’s Documents folder. This file is automatically created or updated by the Remote Desktop Connection client (mstsc.exe) whenever a user initiates an RDP session. It contains session configuration data, such as the remote hostname and display settings. While the presence of this file is normal during legitimate RDP usage, its deletion may indicate an attempt to conceal evidence of remote access activity. Threat actors and red team operators often remove Default.rdp as part of post-access cleanup to evade forensic detection. Detecting this action—especially when correlated with recent RDP activity—can help identify defense evasion techniques and uncover potentially malicious use of remote desktop connections. Monitoring for this file's deletion adds an important layer of visibility into user behavior and can serve as an early indicator of interactive attacker presence.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: '`sysmon` EventCode IN ("23", "26") TargetFilename = "*\\default.rdp" | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_rdp_file_deletion_filter`'
how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: No false positives have been identified at this time.
references:
    - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
    - https://thelocalh0st.github.io/posts/rdp/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a file related to rdp connection named as default.rdp has been deleted on $dest$.
analytic_story:
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint