Splunk rules: 2c

id: '19280.33569'
title: Account Password Changed from Command Line - Windows
description: 'Adversaries may interrupt availability of system and network resources
  by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted,
  locked, or manipulated (ex: changed credentials) to remove access to accounts. This
  use case detects commands involving the use of net.exe to change account passwords.
  Atomics T1531 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(net) OR TERM(net1) OR "net.exe" OR "net1.exe")
  TERM(user) | regex process="(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+"| regex process!="(?i)\/\S+"
  | rex field=process "(?i)user\s+(?<target_account>[^\s]+)\s+\S+" | table _time,
  host, user process, process_*, parent_process, target_account | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- impact:account access removal
technique_id: 
- T1531
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1531/T1531.md#atomic-test-1---change-user-password---windows
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/what-you-need-to-know-about-the-lockergoga-ransomware

name: ASL AWS Defense Evasion Delete CloudWatch Log Group
id: 0f701b38-a0fb-43fd-a83d-d12265f71f33
version: 13
creation_date: '2022-07-19'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This method leverages Amazon Security Lake logs parsed in the OCSF format. The activity is significant because attackers may delete log groups to evade detection and disrupt logging capabilities, hindering incident response efforts. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to undetected data breaches or further malicious actions within the compromised AWS environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=DeleteLogGroup
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_defense_evasion_delete_cloudwatch_log_group_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has deleted CloudWatch logging. Please investigate this activity.
references:
    - https://attack.mitre.org/techniques/T1562/008/
finding:
    title: User $user$ has deleted a CloudWatch logging group
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Bedrock Delete Knowledge Base
id: 8b4e3d62-f743-11ee-9f6e-acde48001123
version: 6
creation_date: '2025-03-25'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This activity could indicate an adversary attempting to remove knowledge bases after compromising credentials, potentially to disrupt business operations or remove traces of data access. Deleting knowledge bases could impact model performance, remove critical business context, or be part of a larger attack to degrade AI capabilities. If confirmed malicious, this could represent a deliberate attempt to cause service disruption or data loss.
data_source:
    - AWS CloudTrail DeleteKnowledgeBase
search: >-
    `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteKnowledgeBase
    | rename user_name as user
    | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.knowledgeBaseId) as knowledgeBaseIds by src user user_agent vendor_account vendor_product dest signature vendor_region
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `aws_bedrock_delete_knowledge_base_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock Knowledge Base management events.
known_false_positives: Legitimate administrators may delete Knowledge Bases as part of normal operations, such as when replacing outdated knowledge bases, removing test resources, or consolidating information. Consider implementing an allowlist for expected administrators who regularly manage Knowledge Base configurations.
references:
    - https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/
    - https://attack.mitre.org/techniques/T1562/
finding:
    title: User $user$ deleted AWS Bedrock Knowledge Base $knowledgeBaseIds$ from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Bedrock Security
asset_type: AWS Account
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Concurrent Sessions From Different Ips
id: 51c04fdb-2746-465a-b86e-b413a09c9085
version: 12
creation_date: '2023-02-01'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute window. It leverages AWS CloudTrail logs, specifically the `DescribeEventAggregates` event, to detect this behavior. This activity is significant as it may indicate a session hijacking attack, where an adversary uses stolen session cookies to access AWS resources from a different location. If confirmed malicious, this could allow unauthorized access to sensitive corporate resources, leading to potential data breaches or further exploitation within the AWS environment.
data_source:
    - AWS CloudTrail DescribeEventAggregates
search: |-
    `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal"
      | bin span=5m _time
      | rename user_name as user
      | stats min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(signature) as signature values(src) as src values(dest) as dest dc(src) as distinct_ip_count
        BY _time user vendor_account
           vendor_region vendor_product
      | where distinct_ip_count > 1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_concurrent_sessions_from_different_ips_filter`
how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
references:
    - https://attack.mitre.org/techniques/T1185/
    - https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
    - https://github.com/kgretzky/evilginx2
finding:
    title: User $user$ has concurrent sessions from more than one unique IP address $src$ in the span of 5 minutes.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Compromised User Account
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Citrix ShareFile Exploitation CVE-2023-24489
id: 172c59f2-5fae-45e5-8e51-94445143e93f
version: 8
creation_date: '2023-07-26'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects potentially malicious file upload attempts to Citrix ShareFile via specific suspicious URLs and the HTTP POST method. It leverages the Web datamodel to identify URL patterns such as "/documentum/upload.aspx?parentid=", "/documentum/upload.aspx?filename=", and "/documentum/upload.aspx?uploadId=*", combined with the HTTP POST method. This activity is significant for a SOC as it may indicate an attempt to upload harmful scripts or content, potentially compromising the Documentum application. If confirmed malicious, this could lead to unauthorized access, data breaches, and operational disruptions.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/documentum/upload.aspx?*"
    Web.url IN (
        "*parentid=*",
        "*filename=*",
        "*uploadId=*"
    )
    Web.url IN (
        "*unzip=*",
        "*raw=*"
    )
    Web.http_method=POST

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `citrix_sharefile_exploitation_cve_2023_24489_filter`
how_to_implement: |-
    Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. The ShareFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not.
known_false_positives: |-
    False positives may be present, filtering may be needed.
    Also, restricting to known web servers running IIS or ShareFile will change this from Hunting to TTP.
references:
    - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
analytic_story:
    - Citrix ShareFile RCE CVE-2023-24489
asset_type: Network
cve:
    - CVE-2023-24489
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Detect Certipy File Modifications
id: 7e3df743-b1d8-4631-8fa8-bd5819688876
version: 12
creation_date: '2023-07-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. It leverages endpoint process and filesystem data to spot the creation of files with specific names or extensions associated with Certipy's information gathering and exfiltration activities. This activity is significant as it indicates potential reconnaissance and data exfiltration efforts by an attacker. If confirmed malicious, this could lead to unauthorized access to sensitive AD CS information, enabling further attacks or privilege escalation within the network.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name IN ("*_certipy.zip","*_certipy.txt", "*_certipy.json", "*.ccache")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_certipy_file_modifications_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints as well as file creation or deletion events.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/ly4k/Certipy
finding:
    title: Suspicious files $file_name$ related to Certipy detected on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious files $file_name$ related to Certipy detected on $dest$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Windows Certificate Services
    - Data Exfiltration
    - Ingress Tool Transfer
asset_type: Endpoint
mitre_attack_id:
    - T1649
    - T1560
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27060.49388'
title: DLL Called with RS32
description: Threat actors including Qbot have been observed using rundll32.exe to
  invoke the RS32 function during post-compromise activity. This use case detects
  DLL files invoking RS32 , accounting for instances where rundll32.exe has been renamed.
  While these exexcutions may be legitimate, unexpected executions should be investigated.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ".dll" "RS32" | where match(process, "(?i)\.dll\,RS32")
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  called_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/blog/lolbins-abuse/

name: Elevated Group Discovery with PowerView
id: 10d62950-0de5-4199-a710-cff9ea79b413
version: 11
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `Get-DomainGroupMember` cmdlet from PowerView, identified through PowerShell Script Block Logging (EventCode=4104). This cmdlet is used to enumerate members of elevated domain groups such as Domain Admins and Enterprise Admins. Monitoring this activity is crucial as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within the domain. If confirmed malicious, this activity could lead to targeted attacks on privileged accounts, facilitating further compromise and lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroupMember*") AND ScriptBlockText IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*",  "*Dns Admins*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `elevated_group_discovery_with_powerview_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerView for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/
    - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
    - https://attack.mitre.org/techniques/T1069/002/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31087.55677'
title: EnableLUA Registry Value Modified
description: Adversaries may bypass UAC mechanisms to elevate process privileges on
  system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. This use case detects
  registry modification events or process executions with registry modification commands
  targeting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
  "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=13) OR "<EventID>13<"))
  "EnableLUA" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" | table
  _time, host, user, process process_name, parent_process_name, signature_id, dest_ip,
  registry_value_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1548/002/

id: '29739.53779'
title: Impacket atexec.py  Execution
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case process creation events matching characteristics of Impacket
  atexec.py executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("cmd.exe" OR "powershell.exe" OR "pwsh.exe") " /c " "\\Windows\\Temp"
  ("2&gt;&amp;1" OR "2&>1") | regex process="(?i)Temp\x5c[A-Za-z]{8}\.tmp" | table
  _time, host, user, process, parent_process_name, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- PowerShell logs
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

name: Ivanti EPM SQL Injection Remote Code Execution
id: e20564ca-c86c-4e30-acdb-a8486673426f
version: 11
creation_date: '2024-07-25'
modification_date: '2026-05-13'
author: Michael Haag
status: production
type: TTP
description: |-
    This detection identifies potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824.
    The vulnerability, which has a CVSS score of 9.8, allows for remote code execution through the `RecordGoodApp` function in the `PatchBiz.dll` file.
    An attacker can exploit this vulnerability by manipulating the `goodApp.md5` value in an HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint, leading to unauthorized command execution on the server.
    Monitoring for unusual SQL commands and HTTP requests to this endpoint can help identify exploitation attempts.
    Note that, the detection is focused on the URI path, HTTP method and status code of 200, indicating potential exploitation.
    To properly identify if this was successful, TLS inspection and additional network traffic analysis is required as the xp_cmdshell comes in via the request body.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/WSStatusEvents/EventHandler.asmx"
    Web.http_method=POST
    Web.status=200

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ivanti_epm_sql_injection_remote_code_execution_filter`
how_to_implement: |-
    The detection is based on monitoring HTTP POST requests to the `/WSStatusEvents/EventHandler.asmx` endpoint with a status code of 200. The detection is focused on the URI path, HTTP method, and status code, which can indicate potential exploitation of the CVE-2024-29824 vulnerability. To implement this detection, ensure that you have enabled the necessary data sources and are ingesting HTTP traffic data. The detection can be implemented using Splunk Enterprise Security and Splunk Cloud with the provided search query. The search query should be scheduled to run at regular intervals to detect potential exploitation attempts. Additionally, consider implementing TLS inspection or network traffic analysis (IDS/IPS) to identify successful exploitation attempts.
known_false_positives: |-
    False positives are not expected, as this detection is based on monitoring HTTP POST requests to a specific endpoint with a status code of 200. However, ensure that legitimate requests to the `/WSStatusEvents/EventHandler.asmx` endpoint are accounted for in the environment to avoid false positives.
references:
    - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29824
    - https://github.com/projectdiscovery/nuclei-templates/pull/10020/files
finding:
    title: Potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824 against $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ivanti EPM Vulnerabilities
    - GhostRedirector IIS Module and Rungan Backdoor
    - Hellcat Ransomware
asset_type: Web Server
cve:
    - CVE-2024-29824
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: MacOS AppleScript Shell Execution and Compilation
id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4
version: 1
creation_date: '2026-09-03'
modification_date: '2026-09-03'
author: Radka Viskova, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic.
    The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host.
    It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly.
    Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name IN ("osascript", "osacompile")
    Processes.process="*do *"
    Processes.process="* shell *"
    Processes.process="* script*"

    BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`

    | eval activity_type=case(
            process_name="osascript", "AppleScript Shell Command Execution",
            process_name="osacompile", "AppleScript Compilation or Staging"
        )

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`

    | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product

    | `macos_applescript_shell_execution_and_compilation_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models.
known_false_positives: |-
    Legitimate administrative scripts or automation tools using Applescript.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/techniques/T1059/002/
    - https://www.loobins.io/binaries/osascript/
    - https://redcanary.com/threat-detection-report/techniques/applescript/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: AppleScript shell execution or compilation via [$process_name$] with commandline [$process$] was observed on [$dest$].
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1059.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1050.1052'
title: Malicious Document Execution
description: 'This rule is attempting to detect anytime a Microsoft Office OR Adobe
  program (ex. Word, Excel, Adobe) spawns a process that could be indicative of those
  Office programs used to deliver malicious code. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT10/menuPass, APT29, APT34/OilRig, APT37, Arid Viper/APT C-23, Blind Eagle/APT-C-36,
  Carbanak, Evilnum, FIN6, FIN7, Gamaredon Group/Shuckworm, Kimsuky, Lazarus, ModifiedElephant,
  MuddyWater, NewsPenguin, RedEyes, RomCom, SideWinder, TA428, TA505, TA551, Turla
  (akaSecret Blizzard, KRYPTON, and UAC-0003), Winter Vivern, WIRTE, Wizard Spider
  -- Software Association: Bazarloder, Black Basta, Clop, Conti, Dridex, Emotet, GlowSand,
  Hancitor, IcedID, Lockbit, MINEBRIDGE, MirrorBlast, PowerShortShell, QakBot, RATDispenser,
  Sodinokibi/REvil, SquirrelWaffle, Trickbot, Zumkong -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 AND (TERM("powershell.exe")
  OR TERM("cmd.exe") OR TERM("wscript.exe") OR TERM("cscript.exe") OR "regsvr32.exe"
  OR "rundll32.exe" OR "wmic" OR "control.exe") AND ("Microsoft Office" OR "WINWORD.EXE"
  OR "EXCEL.EXE" OR "POWERPNT.EXE" OR "ONENOTE.EXE" OR "MSACCESS.EXE" OR "OUTLOOK.EXE"
  OR "VISIO.EXE" OR "WINPROJ.EXE" OR "AcroRd32.exe" OR "Acrobat.exe" OR "FoxitPhantomPDF.exe"
  OR "FoxitReader.exe" OR "wordpad.exe" ) | table _time, host, user process, parent_*,
  process_*, signature_id | bin span=1s | stats values(*) as * by _time, host | where
  match(parent_process_path,"(?i)(Microsoft Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(ONENOTE\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(AcroRd32\.exe)|(Acrobat\.exe)|(FoxitPhantomPDF\.exe)|(FoxitReader\.exe)|(wordpad.exe)") '
techniques:
- initial-access:phishing:spearphishing attachment
- execution:user execution:malicious link
- execution:user execution:malicious file
technique_id:
- T1566.001
- T1204.001
- T1204.002
data_category:
- Windows Sysmon
references:
- https://success.trendmicro.com/solution/000279049

name: Okta Suspicious Activity Reported
id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
version: 12
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the `user.account.report_suspicious_activity_by_enduser` event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.
data_source:
    - Okta
search: |-
    `okta` eventType=user.account.report_suspicious_activity_by_enduser
      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
        BY user dest src
           eventType client.userAgent.rawUserAgent client.userAgent.browser
           client.geographicalContext.city client.geographicalContext.country
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_suspicious_activity_reported_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). Additionally, it necessitates the activation of suspicious activity reporting and training for associates to report such activities.
known_false_positives: False positives should be minimal, given the high fidelity of this detection. marker.
references:
    - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
finding:
    title: A user [$user$] reported suspicious activity in Okta. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1078.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '21595.38143'
title: regsvr32 Referencing Unusual Paths
description: Adversaries may abuse regsvr32.exe to proxy execution of malicious code.
  regsvr32 is a command-line program used to register and unregister object linking
  and embedding controls including .dlls. This use case detects executions of regsvr32
  involving frequently abused file paths as observed with the DarkWatchMan remote
  access trojan. Applications with normal use from AppData\Local should be whitelisted
  using the full file path. LOLBAS/LOLBINS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(regsvr32) ("\\Temp\\" OR "\\AppData\\Local"
  OR "\\Users\\Public") | where (match(process, "(?i)\x5c(Temp|Appdata\x5cLocal|Users\x5cPublic)")
  and match(process_name, "(?i)regsvr32\.exe")) | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

name: Remote Process Instantiation via WinRM and Winrs
id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
version: 12
creation_date: '2021-11-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `winrs.exe` with command-line arguments used to start a process on a remote endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and lateral spread within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=winrs.exe
            OR
            Processes.original_file_name=winrs.exe
        )
        (Processes.process="*-r:*" OR Processes.process="*-remote:*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_process_instantiation_via_winrm_and_winrs_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may leverage WinRM and WinRs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
references:
    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
    - https://attack.mitre.org/techniques/T1021/006/
finding:
    title: A process was started on a remote endpoint from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1021.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 with no Command Line Arguments with Network
id: 35307032-a12d-11eb-835f-acde48001122
version: 16
creation_date: '2021-04-19'
modification_date: '2026-05-13'
author: Steven Dick, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of rundll32.exe without command line arguments, followed by a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry and network traffic data. It is significant because rundll32.exe typically requires arguments to function, and its absence is often associated with malicious activity, such as Cobalt Strike. If confirmed malicious, this activity could indicate an attempt to establish unauthorized network connections, potentially leading to data exfiltration or further compromise of the system.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime FROM datamodel=Endpoint.Processes where
    `process_rundll32`
    Processes.process IN (
      "*rundll32",
      "*rundll32.exe",
      "*rundll32.exe\""
    )
    by host _time span=1h Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | rename dest as src
    | join host process_id
    [
      | tstats `security_content_summariesonly` count
      FROM datamodel=Network_Traffic.All_Traffic where
      All_Traffic.dest_port != 0
      by host All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out
         All_Traffic.dest  All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
         All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
         All_Traffic.transport All_Traffic.user All_Traffic.vendor_product All_Traffic.direction
         All_Traffic.process_id
      | `drop_dm_object_name(All_Traffic)`
    ]
    | `rundll32_with_no_command_line_arguments_with_network_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
    - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
finding:
    title: A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - BlackSuit Ransomware
    - Suspicious Rundll32 Activity
    - Graceful Wipe Out Attack
    - Cobalt Strike
    - Compromised Windows Host
    - PrintNightmare CVE-2021-34527
    - BlackByte Ransomware
    - Cactus Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: USN Journal Deletion
id: b6e0ff70-b122-4227-9368-4cf322ab43c3
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of the USN Journal using the fsutil.exe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because the USN Journal maintains a log of all changes made to files on the disk, and its deletion can be an indicator of an attempt to cover tracks or hinder forensic investigations. If confirmed malicious, this action could allow an attacker to obscure their activities, making it difficult to trace file modifications and potentially compromising incident response efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count values(Processes.process) as process
            values(Processes.parent_process) as parent_process
            min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name=fsutil.exe
    Processes.process = "*usn*"
    Processes.process = "*deletejournal*"

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `usn_journal_deletion_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
finding:
    title: Possible USN journal deletion on $dest$ via $process$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Log Manipulation
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium Process Launched with Logging Disabled
id: d31de944-4e61-468f-9154-e50690f0e99e
version: 5
creation_date: '2026-02-02'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects instances of Chromium-based browser processes on Windows launched with logging disabled via command-line arguments such as --disable-logging and --disable-logging-redirect.
    The --disable-logging flag forces browser logging to be disabled, while --disable-logging-redirect disables log redirection and is commonly used for testing or debugging scenarios.
    Logging is enabled by default in Chromium debug builds, making these flags more likely to appear in debug or development environments.
    While these options may be legitimately used by automation frameworks, debugging workflows, or isolated testing environments, they are also leveraged by malware and malicious scripts to evade security monitoring.
    Analysts should review the parent process, full command-line parameters, and execution context to determine whether the behavior is expected or potentially suspicious.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes
    where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
    Processes.process = "*--disable-logging*"
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_process_launched_with_logging_disabled_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html
    - https://peter.sh/experiments/chromium-command-line-switches/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by the user $user$ with the command-line $process$.
        - field: user
          type: user
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by the user $user$ with the command-line $process$.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1497
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Developer-Signed MSIX Package Installation
id: 2c0427aa-982c-4e97-bc33-bddeda4fd095
version: 5
creation_date: '2025-08-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This detection identifies the installation of developer-signed MSIX packages that lack Microsoft Store signatures. All malicious MSIX packages observed in recent threat campaigns (including those from FIN7, Zloader/Storm-0569, and FakeBat/Storm-1113) were developer-signed rather than Microsoft Store signed. Microsoft Store apps have specific publisher IDs containing '8wekyb3d8bbwe' or 'cw5n1h2txyewy', while developer-signed packages lack these identifiers. This detection focuses on EventID 855 from the Microsoft-Windows-AppXDeployment-Server/Operational logs, which indicates a completed package installation.
data_source:
    - Windows Event Log AppXDeployment-Server 855
search: |-
    `wineventlog_appxdeploymentserver` EventCode=855 NOT PackageMoniker IN ("*8wekyb3d8bbwe*","*cw5n1h2txyewy*")
      | stats count min(_time) as firstTime max(_time) as lastTime values(PackageMoniker) as PackageMoniker
        BY dvc EventCode user_id
      | rename dvc as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_developer_signed_msix_package_installation_filter`
how_to_implement: To implement this detection, you need to be collecting Windows Event logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel. In Splunk, this typically requires the Windows TA and configuration to collect from this specific channel. Ensure your Windows event collection is properly configured to capture EventCode 855 from the Microsoft-Windows-AppXDeploymentServer/Operational log.
known_false_positives: Legitimate developer-signed applications that are not from the Microsoft Store will trigger this detection. Organizations should maintain a baseline of expected developer-signed applications in their environment and tune the detection accordingly. Common legitimate developer-signed applications include in-house developed applications and some third-party applications that are not distributed through the Microsoft Store.
references:
    - https://redcanary.com/blog/threat-intelligence/msix-installers/
    - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
    - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
    - https://redcanary.com/blog/threat-detection/code-signing-certificates/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A developer-signed MSIX package "$PackageMoniker$" was installed on $dest$ by user $user_id$.
threat_objects:
    - field: PackageMoniker
      type: file_name
analytic_story:
    - MSIX Package Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1553.005
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defenses Disable Auto Logger Session
id: dc6a5613-d024-47e7-9997-ab6477a483d3
version: 9
creation_date: '2020-11-06'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic detects the disabling of an AutoLogger session or one of its providers, by identifying changes to the Registry values "Start" and "Enabled" part of the "\WMI\Autologger\" key path. It leverages data from the Endpoint.Registry datamodel to monitor specific registry paths and values. This activity is significant as attackers and adversaries can leverage this in order to evade defense and blind EDRs and log ingest tooling. If confirmed malicious, this action could allow an attacker to conceal their activities, making it harder to detect further malicious actions and maintain persistence on the compromised endpoint.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\WMI\\Autologger\\*" (Registry.registry_value_name="Start" OR Registry.registry_value_name="Enabled") Registry.registry_value_data ="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_auto_logger_session_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
    - https://app.any.run/tasks/45f5d114-91ea-486c-ab01-41c4093d2861/
    - https://isc.sans.edu/diary/rss/28628
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Auto Logger Session or Provider registry value set to 'disabled' on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows RunMRU Registry Key or Value Deleted
id: e651795f-b2c9-4a84-a18a-b901018a3bfa
version: 4
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion or modification of Most Recently Used (MRU) command entries stored within the Windows Registry. Adversaries often clear these registry keys, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU, to remove forensic evidence of commands executed via the Windows Run dialog or other system utilities. This activity aims to obscure their actions, hinder incident response efforts, and evade detection. Detection focuses on monitoring for changes (deletion of values or modification of the MRUList value) to these specific registry paths, particularly when performed by unusual processes or outside of typical user behavior. Anomalous deletion events can indicate an attempt at defense evasion or post-exploitation cleanup by a malicious actor.
data_source:
    - Sysmon EventID 12
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_registry_key_or_value_deleted_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: This event can be seen when administrator delete a history manually or uninstall/reinstall a software that creates MRU registry entry. It is recommended to check this alert with high priority.
references:
    - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity-7394805779448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://www.esentire.com/blog/evalusion-campaign-delivers-amatera-stealer-and-netsupport-rat
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A most recent used entry was deleted on $dest$ within the Windows registry.
analytic_story:
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint