Splunk rules: 2d

id: '17332.28223'
title: 3CXDesktopApp.exe Execution
description: 'Malicious activity has been detected on March 29, 2023, originating
  from a legitimate and signed binary called 3CXDesktopApp, which is a softphone application
  from 3CX. This malicious activity includes beaconing to infrastructure controlled
  by the attackers, deployment of additional payloads in the second stage, and in
  a few cases, direct interaction by the attackers with the system. - Campaign: SmoothOperator
  - Threat Actor Association: Lazarus Group (aka Labyrinth Chollima)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) ("3CXDesktopApp.exe" OR "3CX Desktop App") | table _time, host,
  user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- initial-access:supply chain compromise
- execution:user execution:malicious file
technique_id:
- T1218
- T1195
- T1204.002
data_category:
- Windows Sysmon
references:
- https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/

name: Access LSASS Memory for Dump Creation
id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
version: 16
creation_date: '2019-12-11'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
data_source:
    - Sysmon EventID 10
search: |-
    `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY CallTrace EventID GrantedAccess
           Guid Opcode ProcessID
           SecurityID SourceImage SourceProcessGUID
           SourceProcessId TargetImage TargetProcessGUID
           TargetProcessId UserID dest
           granted_access parent_process_exec parent_process_guid
           parent_process_id parent_process_name parent_process_path
           process_exec process_guid process_id
           process_name process_path signature
           signature_id user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `access_lsass_memory_for_dump_creation_filter`
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
references:
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
finding:
    title: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: TargetImage
      type: process
analytic_story:
    - CISA AA23-347A
    - Credential Dumping
    - Cactus Ransomware
    - Lokibot
    - Scattered Lapsus$ Hunters
asset_type: Windows
mitre_attack_id:
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Adobe ColdFusion Access Control Bypass
id: d6821c0b-fcdc-4c95-a77f-e10752fae41a
version: 10
creation_date: '2023-08-23'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360.
    It monitors requests to specific ColdFusion Administrator endpoints, especially those with an unexpected additional forward slash, using the Web datamodel.
    This activity is significant for a SOC as it indicates attempts to bypass access controls, which can lead to unauthorized access to ColdFusion administration endpoints.
    If confirmed malicious, this could result in data theft, brute force attacks, or further exploitation of other vulnerabilities, posing a serious security risk to the environment.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url IN (
        "*//CFIDE/adminapi*",
        "*//CFIDE/administrator*",
        "*//CFIDE/componentutils*",
        "*//CFIDE/main*",
        "*//CFIDE/restplay*",
        "*//CFIDE/servermanager*",
        "*//CFIDE/wizards*",
        "*//restplay*",
    )
    Web.status=200

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `adobe_coldfusion_access_control_bypass_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: |-
    This analytic is limited to HTTP Status 200.
    False positives may occur if the URI path is IP-restricted or externally blocked.
    It is recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
references:
    - https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible exploitation of CVE-2023-29298 against $dest$ via $url$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
asset_type: Network
cve:
    - CVE-2023-29298
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Azure AD Unusual Number of Failed Authentications From Ip
id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
version: 13
creation_date: '2022-07-11'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. It uses Azure SignInLogs data and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual numbers of failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
      | rename properties.* as *
      | bucket span=5m _time
      | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName values(dest) as dest  values(user) as user
        BY _time, src, vendor_account,
           vendor_product
      | eventstats avg(unique_accounts) as ip_avg, stdev(unique_accounts) as ip_std
        BY src
      | eval upperBound=(ip_avg+ip_std*3)
      | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,0)
      | where isOutlier = 1
      | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
intermediate_findings:
    entities:
        - field: userPrincipalName
          type: user
          score: 20
          message: Possible Password Spraying attack against Azure AD from source ip $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1110.003
    - T1110.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Cisco ASA - User Account Deleted From Local Database
id: 2d4b9e7f-5c3a-4d8e-9b1f-8a6c5e2d4f7a
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects deletion of user accounts from Cisco ASA devices via CLI or ASDM.
    Adversaries may delete local accounts to cover their tracks, remove evidence of their activities, disrupt incident response efforts, or deny legitimate administrator access during an attack. Account deletion can also indicate an attempt to hide the creation of temporary accounts used during compromise.
    The detection monitors for ASA message ID 502102, which is generated whenever a local user account is deleted from the device, capturing details including the deleted username, privilege level, and the administrator who performed the deletion.
    Investigate unexpected account deletions, especially those involving privileged accounts (level 15), deletions performed outside business hours, deletions by non-administrative users, or deletions that coincide with other suspicious activities.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (502102)
    | fillnull
    | stats count earliest(_time) as firstTime
            latest(_time) as lastTime
            values(action) as action
            values(message_id) as message_id
            values(result) as result
            values(privilege_level) as privilege_level
      by host user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___user_account_deleted_from_local_database_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502102.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502102.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate deletions occur during employee offboarding, contractor removal, account cleanup, or service account decommissioning. Verify against HR records and change management tickets.
    Filter known admin accounts during business hours.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773969
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Local user account $user$ with privilege level $privilege_level$ was deleted from Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: Local user account $user$ with privilege level $privilege_level$ was deleted from Cisco ASA host $host$.
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1531
    - T1070.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco IOS XE Request Platform Package Describe Shell Pattern
id: a113a8be-7386-46e0-a079-d9fd46f9631f
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: TTP
description: |
    This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. Indicative of Slat Typhoon tradecraft.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("AAA", "HA_EM")
    mnemonic IN ("AAA_ACCOUNTING_MESSAGE", "LOG")
    message_text="*request platform software package describe*"
    message_text IN ("*--filename=/(bash)n*", "*--filename=$(bash)n*")

    | eval dest=coalesce(host, dvc, dest, "unknown")
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(message_text) as message
      by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_request_platform_package_describe_shell_pattern_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Command visibility requires AAA command accounting or EEM catchall command logging.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
finding:
    title: Suspicious request platform package describe command was issued on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects: []
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1059
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '5746.6025'
title: Executable Process from Suspicious Folder
description: 'Detects the execution of executable process spawned by powershell or
  similar processes from suspicious file locations like temp, appdata, and downloads.
  - Threat Actor Association: Andariel, APT10/menuPass, APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT34/OilRig, Blind Eagle/APT-C-36,
  Carbanak, Evilnum, FIN7, FIN8, GoldenJackal, Gorgon Group, Kimsuky, Lazarus, Magic
  Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Mustang Panda
  (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA505,
  TA551, UNC2465, Volt Typhoon, WinterVivern/UAC-0114 -- Software Association: Babuk,
  BadHatch, Bazar, Blackbyte, Clop, IcedID, Lockbit, MagicRAT, PowerShortShell, PYSA/Mespinoza,
  SmokedHAM, SolidBit, RATDispenser, Remcos, TA413, TargetCompany, Trickbot, Trigona,
  Yellow Cockatoo/Jupiter Infostealer, Vidar Stealer, WhisperGate - #TrendingThreat
  #Russia #Ukraine - Atomics T1574.001 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  ("powershell.exe" OR "cmd.exe" OR "services.exe" OR "dllhost.exe" OR "rundll32.exe"
  OR "cscript.exe" OR "wscript.exe" OR "NTDLL.dll") AND ("Temporary Internet Files"
  OR "TEMP" OR "Downloads" OR "Appdata") | regex parent_process_name="((?i)(powershell\.exe)|(cmd\.exe)|(services\.exe)|(dllhost\.exe)|(rundll32\.exe)|(cscript\.exe)|(wscript\.exe)|(NTDLL\.dll))"|
  regex process_path!="(?i)WindowsUpdateLog"| regex process_path="(?i)Temp|Downloads|Appdata"
  | table _time, host, user dest, direction, event_id, eventtype, parent_process,
  parent_process_id, parent_process_name, parent_process_path, process, process_id,
  process_name, process_path, signature_id, tag, user, user_id | bin span=1s | stats
  values(*) as * by _time, host, process '
techniques:
- execution:command and scripting interpreter
- execution:user execution
- execution:command and scripting interpreter:visual basic
- defense-evasion:system binary proxy execution:rundll32
- execution:command and scripting interpreter:javascript
technique_id:
- T1059
- T1204
- T1059.007
- T1218.011
- T1059.005
data_category:
- Windows Sysmon
references:
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

name: Executables Or Script Creation In Temp Path
id: e0422b71-2c05-4f32-8754-01fb415f49c9
version: 27
creation_date: '2021-05-07'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
    This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
    If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Filesystem where

    Filesystem.action= "created"
    Filesystem.file_name IN (
        "*.bat",
        "*.cmd",
        "*.com",
        "*.dll",
        "*.exe",
        "*.js",
        "*.msc",
        "*.pif",
        "*.ps1",
        "*.sys",
        "*.vbe",
        "*.vbs"
    )
    Filesystem.file_path IN (
        "*:\\Temp\\*",
        "*:\\Windows\\Temp\\*",
        "*\\AppData\\Local\\Temp\\*"
    )
    NOT Filesystem.file_path IN ("*\\__PSScriptPolicyTest_*")

    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid
       Filesystem.process_id Filesystem.user
       Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `executables_or_script_creation_in_temp_path_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: Executable creation and certain script extensions in temporary paths can very common in certain environments and legitimate use cases. It is important to review and filter these events based on your organization''s normal activity and policies.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://twitter.com/pr0xylife/status/1590394227758104576
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Executable or script with file name $file_name$ located $file_path$ and process_id $process_id$ was created in temporary folder by $user$
threat_objects:
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - Snake Keylogger
    - China-Nexus Threat Activity
    - Remcos
    - LockBit Ransomware
    - AsyncRAT
    - DarkCrystal RAT
    - Derusbi
    - WinDealer RAT
    - DarkGate Malware
    - AcidPour
    - ValleyRAT
    - Crypto Stealer
    - PlugX
    - Data Destruction
    - Qakbot
    - CISA AA23-347A
    - Hermetic Wiper
    - Volt Typhoon
    - Double Zero Destructor
    - NjRAT
    - Trickbot
    - Meduza Stealer
    - AgentTesla
    - SnappyBee
    - Azorult
    - WhisperGate
    - Warzone RAT
    - Swift Slicer
    - Rhysida Ransomware
    - Brute Ratel C4
    - BlackByte Ransomware
    - Graceful Wipe Out Attack
    - Chaos Ransomware
    - Handala Wiper
    - RedLine Stealer
    - Salt Typhoon
    - XMRig
    - MoonPeak
    - Industroyer2
    - Amadey
    - IcedID
    - Interlock Rat
    - APT37 Rustonotto and FadeStealer
    - PromptLock
    - Lokibot
    - SesameOp
    - PromptFlux
    - XML Runner Loader
    - Void Manticore
    - Axios Supply Chain Post Compromise
    - VIP Keylogger
    - RoguePlanet
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Headless Browser Usage
id: 869ba261-c272-47d7-affe-5c0aa85c93d6
version: 11
creation_date: '2023-09-11'
modification_date: '2026-06-25'
author: Michael Haag, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the usage of headless browsers within an organization. It identifies processes containing the "--headless" and "--disable-gpu" command line arguments, which are indicative of headless browsing. This detection leverages data from the Endpoint.Processes datamodel to identify such processes. Monitoring headless browser usage is significant as these tools can be exploited by adversaries for malicious activities like web scraping, automated testing, and undetected web interactions. If confirmed malicious, this activity could lead to unauthorized data extraction, automated attacks, or other covert operations on web applications.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe") (Processes.process="*--headless*" AND Processes.process="*--disable-gpu*")

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `headless_browser_usage_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Administrators may enable or disable this feature for framework testing that may cause some false positive.
references:
    - https://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html
    - https://cert.gov.ua/article/5702579
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by user $user$ with the command-line $process$.
        - field: user
          type: user
          score: 20
          message: A Chromium-based browser process $process_name$ was launched by $parent_process_name$ on $dest$ by user $user$ with the command-line $process$.
threat_objects:
    - field: parent_process
      type: parent_process
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
analytic_story:
    - Browser Hijacking
    - Forest Blizzard
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1497
    - T1564.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31900.56998'
title: Invoke-DCOM.ps1 - PowerShell
description: 'Adversaries may use Valid Accounts to interact with remote machines
  by taking advantage of Distributed Component Object Model (DCOM). The adversary
  may then perform actions as the logged-on user. This use case detects the usage
  of Invoke-DCOM PowerShell script to remotely obtain arbitrary and direct shellcode
  execution through Office applications as well as other Windows objects that contain
  insecure methods. Note: PowerShell logging is recommended for best detection. Detection
  using other log sources is dependent on commands being run in manner that creates
  a new process, such as powershell -c.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(EventCode=4103)
  OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<")) ("MMC20.Application"
  OR "ShellWindows" OR "ShellBrowserWindow" OR "CheckDomain" OR "ServiceCheck" OR
  "MinimizeAll" OR "ServiceStop" OR "ServiceStart" OR "DetectOffice" OR "RegisterXLL"
  OR "ExcelDDE") OR ("9BA05972-F6A8-11CF-A442-00A0C90A8F39" OR "C08AFD90-F2A1-11D1-8455-00A0C91F3880"
  OR "7e0423cd-1119-0928-900c-e6d4a52a0715") ("Application.ServiceStart" OR "Application.ServiceStop"
  OR "Application.IsServiceRunning" OR "Application.ShutDownWindows" OR "Application.GetSystemInformation"
  OR "DDEInitiate" OR "Application.RegisterXLL" OR "Application.ProductCode" OR "Application.MinimizeAll"
  OR "ActiveView.ExecuteShellCommand") | table _time, host, user, process | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:distributed component object model
technique_id:
- T1021.003
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1021/003/
- https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_movement/Invoke-DCOM.ps1
- https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/

name: Linux Auditd Stop Services
id: 43bc9281-753b-4743-b4b7-60af84f085f3
version: 9
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
data_source:
    - Linux Auditd Service Stop
search: |-
    `linux_auditd` type=SERVICE_STOP
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type pid comm
           exe dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_stop_services_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
analytic_story:
    - Industroyer2
    - Data Destruction
    - AwfulShred
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft SharePoint Server Elevation of Privilege
id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859d
version: 10
creation_date: '2023-10-13'
modification_date: '2026-05-13'
author: Michael Haag, Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357.
    It leverages the Web datamodel to monitor for specific API calls and HTTP methods indicative of privilege escalation attempts.
    This activity is significant as it may indicate an attacker is trying to gain unauthorized privileged access to the SharePoint environment.
    If confirmed malicious, the impact could include unauthorized access to sensitive data, potential data theft, and further compromise of the SharePoint server, leading to a broader security breach.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url IN (
        "*/_api/web/siteusers*",
        "*/_api/web/currentuser*"
    )
    Web.status=200
    Web.http_method="GET"

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `microsoft_sharepoint_server_elevation_of_privilege_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Microsoft SharePoint.
known_false_positives: False positives may occur if there are legitimate activities that mimic the exploitation pattern. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
references:
    - https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/
    - https://github.com/LuemmelSec/CVE-2023-29357/blob/main/CVE-2023-29357/Program.cs
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible exploitation of CVE-2023-29357 against $dest$ from $src$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357
asset_type: Web Server
cve:
    - CVE-2023-29357
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: O365 Email Send and Hard Delete Exfiltration Behavior
id: dd7798cf-c4f5-4114-ad0f-beacd9a33708
version: 6
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
data_source:
    - Office 365 Universal Audit Log
    - Office 365 Reporting Message Trace
search: |-
    `o365_messagetrace` Status=Delivered
    | eval mailtime = _time
    | bin _time span=1hr
    | eval user = lower(SenderAddress), recipient = lower(RecipientAddress)
    | eval InternetMessageId = lower(MessageId)
    | join InternetMessageId, user, max=0
      [
      | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
      | eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; ")), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2)), InternetMessageId = lower('Item.InternetMessageId')
      | eval sendtime = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),_time)
      | eval deltime = CASE(Operation IN ("SoftDelete","HardDelete"),_time)
      | bin _time span=1hr
      | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user
      | where opcount > 1 AND firstTime < lastTime
      ]
    | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime  count by subject,user,recipient,Organization
    | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1)
    | where externalRecipient = 1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_send_and_hard_delete_exfiltration_behavior_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ sent and hard deleted an email to an external recipient [$recipient$] within a short timeframe
        - field: recipient
          type: user
          score: 20
          message: The user $user$ sent and hard deleted an email to an external recipient [$recipient$] within a short timeframe
threat_objects:
    - field: subject
      type: email_subject
analytic_story:
    - Office 365 Account Takeover
    - Office 365 Collection Techniques
    - Suspicious Emails
    - Data Destruction
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.001
    - T1070.008
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '6357.18232'
title: Rclone Execution
description: 'Rclone is a command line program to manage files on cloud storage. It
  is a feature rich alternative to cloud vendors'' web storage interfaces. Adversaries
  have been known to use rclone in order to exfiltrate data. -- Threat Actor Association:
  ALPHV/BlackCat, BlackMatter, DarkSide, Daixin Team, FIN7, FIN8 (Syssphinx), Hello
  Kitty / Five Hands, Karakurt, LockBit, Scattered Spider (aka. 0ktapus, UNC3944),
  Turla (akaSecret Blizzard, KRYPTON, and UAC-0003), UNC2628, Wizard Spider - Software
  Association: Akira, AvosLocker, BazarLoader, BianLian, Blackbyte, Blackcat/ALPHV,
  Black Basta, Conti, Lockbit, Ransom Cartel, Royal, Vice Society'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("rclone.exe" OR "rclone32.exe" OR (TERM(serve) OR TERM(COPY) OR TERM(move) OR TERM(COPYto)
  OR TERM(moveto))) | table _time, host, user process, process_*, signature_id, parent_*
  | bin span=1s | stats values(*) as * by _time, host | where (match(process, "(?i)\s+(((copy|move|moveto|copyto)\s+.*\S+:\S+\s+.*\S+:\S+)|(serve\s+(dlna|http|docker|ftp|restic|sftp|webdav)))")
  or match(process_name, "(?i)rclone")) and not match(process_name, "(?i)(cmd|powershell).exe")
  `hec_collect`'
techniques:
- exfiltration:exfiltration over web service:exfiltration to cloud storage
- exfiltration:data transfer size limits
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1567.002
- T1030
- T1048.003
data_category:
- Windows Sysmon
references:
- https://rclone.org/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://unit42.paloaltonetworks.com/royal-ransomware/

name: Scheduled Task Deleted Or Created via CMD
id: d5af132c-7c17-439c-9d31-13d55340f36c
version: 28
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation or deletion of scheduled tasks via schtasks.exe when invoked with create or delete flags, specifically focusing on those executions where the process includes additional parameters such as /tr, /sc, or /ru. The detection uses Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, and filters out events originating from trusted system paths like C:\Windows\System32 or C:\Program Files. It further narrows results to cases where schtasks.exe is launched by potentially suspicious parent processes such as cmd.exe, wscript.exe, or cscript.exe, and excludes service accounts. This behavior may indicate adversary efforts to gain persistence or evade detection by manipulating scheduled tasks using scripts or command shells. If confirmed malicious, such activity could lead to unauthorized code execution or the removal of monitoring mechanisms on endpoints.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
        count
        min(_time) as firstTime
        max(_time) as lastTime
    FROM datamodel=Endpoint.Processes WHERE

    Processes.parent_process_name="cmd.exe"
    Processes.process_name="schtasks.exe"
    Processes.process IN (
        "*/create*",
        "*-create*",
        "*/delete*",
        "*-delete*"
    )
    NOT Processes.process IN (
        "* \"C:\\Program Files (x86)\\*",
        "* \"C:\\Program Files\\*",
        "* \"C:\\Windows\\System32\\*",
        "* \"C:\\Windows\\SysWOW64\\*",
        "* C:\\Program Files (x86)\\*",
        "* C:\\Program Files\\*",
        "* C:\\Windows\\System32\\*",
        "* C:\\Windows\\SysWOW64\\*"
    )
    NOT Processes.user="*$"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `scheduled_task_deleted_or_created_via_cmd_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    While it is possible for legitimate scripts or administrators to trigger this behavior, filtering can be applied based on the parent process and application to reduce false positives.
    Analysts should reference the provided references to understand the context and threat landscape associated with this activity.
references:
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
    - https://www.joesandbox.com/analysis/691823/0/html
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A parent process [$parent_process_name$] with commandline [$parent_process$] spawned a schedule task process [$process_name$] with create or delete commandline [$process$] on host [$dest$]
        - field: user
          type: user
          score: 20
          message: A parent process [$parent_process_name$] with commandline [$parent_process$] spawned a schedule task process [$process_name$] with create or delete commandline [$process$] on host [$dest$]
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - ShrinkLocker
    - AgentTesla
    - CISA AA24-241A
    - Winter Vivern
    - Quasar RAT
    - Rhysida Ransomware
    - Sandworm Tools
    - DarkCrystal RAT
    - Qakbot
    - China-Nexus Threat Activity
    - XWorm
    - CISA AA23-347A
    - Azorult
    - Living Off The Land
    - Salt Typhoon
    - Trickbot
    - NOBELIUM Group
    - CISA AA22-257A
    - Medusa Ransomware
    - Phemedrone Stealer
    - NjRAT
    - DHS Report TA18-074A
    - Scheduled Tasks
    - Prestige Ransomware
    - Amadey
    - AsyncRAT
    - RedLine Stealer
    - Windows Persistence Techniques
    - MoonPeak
    - Scattered Spider
    - 0bj3ctivity Stealer
    - APT37 Rustonotto and FadeStealer
    - Lokibot
    - NetSupport RMM Tool Abuse
    - ValleyRAT
    - PlugX
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '21196.37652'
title: Script Connected to External Destination - Windows
description: Adversaries may use scripts to connect to external locations for C2 communications,
  downloading and executing payloads, data exfiltration, or redirection. This use
  case detects when a Windows script interpreter (wscript, cscript, mshta, rundll32)
  connects to external IPv4 or IPv6 destinations.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) OR "<EventID>3<")
  TERM(wscript) OR TERM(cscript) OR TERM(mshta) OR TERM(rundll32) | regex dest_ip!="(?i)^(127|10|172\.1[6-9]|172\.2[0-9]|172\.3[0-1]|192\.168|169\.254|20)\.|(::1|0:0:0:0:0:0:0:1|fe80:|fc|fd)"
  | table _time, host, user parent_*, process, process_*, dest_ip, dest_host | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- exfiltration:exfiltration over c2 channel
technique_id: 
- T1059
- T1041
data_category:
- Windows Sysmon
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

name: Splunk Sensitive Information Disclosure in DEBUG Logging Channels
id: 93dc7182-c5da-4085-82ec-401abf33d623
version: 6
creation_date: '2024-10-14'
modification_date: '2026-05-14'
author: Rod Soto, Eric McGinnis, Splunk
status: production
type: Hunting
description: In Splunk versions 9.3, 9.2, 9.1, 9.1.5 Applications which have been enabled with logging level DEBUG may write sensitive information such as keys, tokens, or other sensitive strings into the internal index.
data_source:
    - Splunk
search: |-
    `splunkd` log_level="DEBUG" AND component IN ("REST_Calls", "AdminManager", "JSONWebToken")
    | stats count min(_time) as firstTime max(_time) as lastTime by host splunk_server log_level component event_message
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter`
how_to_implement: Requires access to _internal index. It is recommended to inventory and modify the search for specific apps that may have DEBUG logging enabled.
known_false_positives: There will be false positives as not every message to the DEBUG log will expose sensitive information, such as keys or other secrets.
references:
    - https://advisory.splunk.com/advisories/SVD-2024-0301
    - https://advisory.splunk.com/advisories/SVD-2024-1008
    - https://advisory.splunk.com/advisories/SVD-2024-1009
analytic_story:
    - Splunk Vulnerabilities
asset_type: Splunk Server
cve:
    - CVE-2024-29945
    - CVE-2024-45738
    - CVE-2024-45739
mitre_attack_id:
    - T1552
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1139.1215'
title: Tunneling Process Created
description: 'Adversaries may tunnel network communications to and from a victim system
  within a separate protocol to avoid detection/network filtering and/or enable access
  to otherwise unreachable systems. Common tools include Iodine, DNSCat, and Plink
  -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, APT34, FIN6, Lazarus,
  Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Magnat,
  Memento Team, OilRig, TRACER KITTEN -- Software Association: BadHatch, Lockbit,
  LV, Royal, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) AND (TERM(--dns) OR TERM(server) OR TERM(host)
  OR TERM(com) OR TERM(org) OR TERM(net) OR TERM(info) OR TERM(listen) OR TERM(host)
  OR ("@" AND (TERM(-D) OR TERM(-R) OR TERM(-L)))) | regex process="(?i)(\-\-dns)?((\s+)|(\=))?((server\=)|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\,port\=\d{1,5}.+)|(\w+\.((com)|(org)|(net)|(info)))$)|(\w+\.((com)|(org)|(net)|(info))\:\d{1,5})|(\w+\@(\d{1,3}\.){3}\d{1,3}.+\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5})|(\-(R|D|L).+(\d{1,3}\.){3}\d{1,3}\:\d{1,5}.+\w+\@(\d{1,3}\.){3}\d{1,3})|(\d{1,5}\s+?(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"
  | table _time, host, user, signature_id, process_name, process, user | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- Windows event logs
references:
- https://github.com/yarrick/iodine
- https://github.com/iagox86/dnscat2
- https://github.com/kdsnice/Invoke-Plink