Splunk rules: 2e

id: '17427.29297'
title: Application Discovery - Windows
description: 'Adversaries may attempt to get a listing of software and software versions
  that are installed on a system or in a cloud environment. Adversaries may use the
  information from Software Discovery during automated discovery to shape follow-on
  behaviors, including whether or not the adversary fully infects the target and/or
  attempts specific actions. Adversaries may attempt to enumerate software for a variety
  of reasons, such as figuring out what security measures are present or if the compromised
  system has a version of software that is vulnerable to Exploitation for Privilege
  Escalation. This use case detects commands enumerating applications installed on
  a Windows system. Atomics T1518 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(query) OR (TERM(Get-ItemProperty)
  OR TERM(gp)) "Software" "Uninstall") OR ("wmic" TERM(product)) | regex process="(?i)((\s+query\s+|Get-ItemProperty|gp\s+).*\x5cUninstall\x5c\*)|wmic\s+product\s+get\s+"
  | table _time, host, user, process, process_*, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:software discovery
technique_id: 
- T1518
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518/T1518.md#atomic-test-2---applications-installed

name: AWS ECR Container Scanning Findings Low Informational Unknown
id: cbc95e44-7c22-443f-88fd-0424478f5589
version: 13
creation_date: '2021-08-18'
modification_date: '2026-05-13'
author: Patrick Bareiss, Eric McGinnis Splunk
status: production
type: Anomaly
description: The following analytic identifies low, informational, or unknown severity findings from AWS Elastic Container Registry (ECR) image scans. It leverages AWS CloudTrail logs, specifically the DescribeImageScanFindings event, to detect these findings. This activity is significant for a SOC as it helps in early identification of potential vulnerabilities or misconfigurations in container images, which could be exploited if left unaddressed. If confirmed malicious, these findings could lead to unauthorized access, data breaches, or further exploitation within the containerized environment.
data_source:
    - AWS CloudTrail DescribeImageScanFindings
search: |-
    `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
      | spath path=responseElements.imageScanFindings.findings{} output=findings
      | mvexpand findings
      | spath input=findings
      | search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
      | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product finding_name
           finding_description imageDigest repository
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Vulnerabilities found in repository $repository$
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Azure AD Successful PowerShell Authentication
id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
version: 13
creation_date: '2022-07-12'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. This detection leverages Azure AD SignInLogs to identify successful logins where the appDisplayName is "Microsoft Azure PowerShell." This activity is significant because it is uncommon for regular, non-administrative users to authenticate using PowerShell, and it may indicate enumeration and discovery techniques by an attacker. If confirmed malicious, this activity could allow attackers to perform extensive reconnaissance, potentially leading to privilege escalation or further exploitation within the Azure environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=SignInLogs properties.authenticationDetails{}.succeeded=true properties.appDisplayName="Microsoft Azure PowerShell"
      | rename properties.* as *
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_successful_powershell_authentication_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0
    - https://securitycafe.ro/2022/04/29/pentesting-azure-recon-techniques/
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md
finding:
    title: Successful authentication for user $user$ using PowerShell.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Active Directory
mitre_attack_id:
    - T1078.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: DLLHost with no Command Line Arguments with Network
id: f1c07594-a141-11eb-8407-acde48001122
version: 17
creation_date: '2021-04-19'
modification_date: '2026-05-13'
author: Steven Dick, Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects instances of DLLHost.exe running without
    command line arguments while establishing a network connection.
    This behavior is identified using Endpoint Detection and Response (EDR) telemetry,
    focusing on process execution and network activity data.
    It is significant because DLLHost.exe typically runs with specific arguments,
    and its absence can indicate malicious activity, such as Cobalt Strike usage.
    If confirmed malicious, this activity could allow attackers to execute code,
    move laterally, or exfiltrate data, posing a severe threat to the network's security.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 3
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime FROM datamodel=Endpoint.Processes where
    (
      Processes.process_name=dllhost.exe
      OR
      Processes.original_file_name=dllhost.exe
    )
    Processes.process IN (
      "*dllhost",
      "*dllhost.exe",
      "*dllhost.exe\""
    )
    by host _time span=1h
       Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | rename dest as src
    | join host process_id
    [
      | tstats `security_content_summariesonly`
        count
        latest(All_Traffic.dest) as dest
        latest(All_Traffic.dest_ip) as dest_ip
        latest(All_Traffic.dest_port) as dest_port
        FROM datamodel=Network_Traffic.All_Traffic where
          All_Traffic.dest_port != 0
          by host All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
             All_Traffic.bytes_out All_Traffic.dest  All_Traffic.dest_ip All_Traffic.dest_port
             All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
             All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user
             All_Traffic.vendor_product All_Traffic.direction All_Traffic.process_id
      | `drop_dm_object_name(All_Traffic)`
    ]
    | `dllhost_with_no_command_line_arguments_with_network_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    Although unlikely, some legitimate third party applications
    may use a moved copy of dllhost, triggering a false positive.
references:
    - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
finding:
    title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $src$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $src$ by $user$.
threat_objects:
    - field: parent_process_name
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - BlackByte Ransomware
    - Cobalt Strike
    - Graceful Wipe Out Attack
    - Cactus Ransomware
    - Storm-2460 CLFS Zero Day Exploitation
    - Earth Alux
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: IcedID Exfiltrated Archived File Creation
id: 0db4da70-f14b-11eb-8043-acde48001122
version: 10
creation_date: '2021-08-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the creation of suspicious files named passff.tar and cookie.tar, which are indicative of archived stolen browser information such as history and cookies on a machine compromised with IcedID. It leverages Sysmon EventCode 11 to identify these specific filenames. This activity is significant because it suggests that sensitive browser data has been exfiltrated, which could lead to further exploitation or data breaches. If confirmed malicious, this could allow attackers to access personal information, conduct further phishing attacks, or escalate their presence within the network.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\passff.tar" OR Filesystem.file_path="*\\cookie.tar" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.cisecurity.org/insights/white-papers/security-primer-icedid
analytic_story:
    - IcedID
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ivanti Connect Secure System Information Access via Auth Bypass
id: d51c13dd-a232-4c83-a2bb-72ab36233c5d
version: 9
creation_date: '2024-01-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies attempts to exploit the CVE-2023-46805 and CVE-2024-21887 vulnerabilities in Ivanti Connect Secure. It detects GET requests to the /api/v1/totp/user-backup-code/../../system/system-information URI, which leverage an authentication bypass to access system information. The detection uses the Web datamodel to identify requests with a 200 OK response, indicating a successful exploit attempt. This activity is significant as it reveals potential unauthorized access to sensitive system information. If confirmed malicious, attackers could gain critical insights into the system, facilitating further exploitation and compromise.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url="*/api/v1/totp/user-backup-code/../../system/system-information*" Web.http_method=GET Web.status=200
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ivanti_connect_secure_system_information_access_via_auth_bypass_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the URI path is IP-restricted or externally blocked. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
references:
    - https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve2023-46805_2024_21887.nse
    - https://github.com/projectdiscovery/nuclei-templates/blob/c6b351e71b0fb0e40e222e97038f1fe09ac58194/http/misconfiguration/ivanti/CVE-2023-46085-CVE-2024-21887-mitigation-not-applied.yaml
    - https://github.com/rapid7/metasploit-framework/pull/18708/files
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible exploitation of CVE-2023-46805 and CVE-2024-21887 against $dest$.
analytic_story:
    - Ivanti Connect Secure VPN Vulnerabilities
    - CISA AA24-241A
asset_type: VPN Appliance
cve:
    - CVE-2023-46805
    - CVE-2024-21887
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Base64 Decode Files
id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737
version: 9
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated with encoded malware or unauthorized data access.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command = "*base64*" AND execve_command IN ("*-d*", "* --d*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_base64_decode_files_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://gtfobins.github.io/gtfobins/dd/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$execve_command$] event occurred on host - [$dest$] to decode a file using base64.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1140
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious Privileged Container Execution
id: 29b888db-d6e7-4286-bbf5-39d9f260444c
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host.
    This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*docker *"
    Processes.process="* run*"
    Processes.process IN ("*--privileged*", "*--pid=host*")

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name
       Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory
       Processes.process_path Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path Processes.parent_process_guid
       Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user
       Processes.process_name
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_privileged_container_execution_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Suspicious Privileged Container identified on [$dest$] via [$process_name$] with the Command Line [$process$].
threat_objects:
    - field: process_name
      type: process_name
    - field: process
      type: process
analytic_story:
    - Linux Post-Exploitation
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1610
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Usermod Root UID Set
id: fe143ad6-ef29-4571-be14-0cd08a32ff34
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the use of usermod to set a user's UID to 0. This functionally sets the user as a root user with full permissions. This approach can be used to bypass regular privilege escalation mechanisms, giving the attacker full control over the system while appearing as a regular user in most monitoring tools.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime FROM datamodel=Endpoint.Processes
    WHERE Processes.process_name="usermod"
      AND (Processes.process IN ("* -u 0 *", "* -u 0") OR Processes.process="*--uid 0*")
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_current_directory Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_usermod_root_uid_set_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Setting a user's UID to 0 is extremely rare in legitimate administration — there is almost no valid operational reason to create a second root-equivalent account this way. False positives are expected to be very low. Verify any alert against change management records before dismissing.
references:
    - https://github.com/Aegrah/PANIX
finding:
    title: Linux Usermod Root UID Set identified on $dest$ by $user$ via $process_name$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Potential Usermod Root UID Set by $user$ on $dest$ via $process_name$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Post-Exploitation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1078
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Keychains Dumped
id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9
version: 4
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Jamie Windley, Splunk
status: production
type: TTP
description: |-
    Detects command-line attempts to access or dump macOS Keychain data using native utilities or direct file access.
    This includes credential dumping via the `security` utility (e.g. `dump-keychain -d`), bulk certificate export using `security find-certificate`, and direct file copying of Keychain database files using utilities such as `cat`.
    Keychain files are located in `~/Library/Keychains/`, `/Library/Keychains/`, and `/Network/Library/Keychains/`.
    This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, system services, and certificates.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Processes.parent_process) AS parent_process
            values(Processes.parent_process_exec) AS parent_process_exec
            values(Processes.parent_process_id) AS parent_process_id
            values(Processes.parent_process_name) AS parent_process_name
            values(Processes.parent_process_path) AS parent_process_path

    FROM datamodel=Endpoint.Processes WHERE
    (
        Processes.process_path="/usr/bin/security"
        AND
        (
            (
                Processes.process="*dump-keychain*"
                Processes.process="*-d*"
            )
            OR
            (
                Processes.process="*find-certificate*"
                Processes.process="*-p*"
            )
        )
    )
    OR
    Processes.process="*keychaindump*"
    OR
    (
        Processes.process_name IN (
            "cat",
            "cp",
            "dd",
            "mv"
        )
        Processes.process="*Library/Keychains/*"
        Processes.process="*.keychain*"
    )
    by Processes.action Processes.dest Processes.process Processes.process_hash
    Processes.process_id Processes.process_name Processes.process_path
    Processes.user Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_keychains_dumped_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrators accessing keychain files for troubleshooting or endpoint management.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://gist.github.com/hfeeki/88c12f01d00534e09a84
    - https://ss64.com/mac/security-keychain-settings.html
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md
finding:
    title: Keychains dumped on $dest$ by $user$ via $process$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Keychains dumped on $dest$ by $user$ via $process$
analytic_story:
    - MacOS Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1555.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5696.5958'
title: Modify Exchange Access Settings
description: 'Set-CASMailbox cmdlet to configure client access settings on a mailbox.
  For example, you can configure settings for Exchange ActiveSync, Outlook, Outlook
  on the web, POP3, and IMAP4. Attacker added their own devices as allowed IDs for
  active sync. - Threat Actor Association: APT29/Nobelium/Cozy Bear'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(EventCode=4103)) TERM(Set-CASMailbox) | table _time, host, user signature_id,
  process, process_* `group_events("host",1s)` '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

id: '6144.6643'
title: Output to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. This use case looks for indicators of
  commands being saved to a file such as ">" or ">>". Typically a new process
  is not created when executed from a command prompt, however adversaries may output
  process results to a txt document during discovery. -- Threat Actor Association:
  Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  OilRig, TeamTNT - Software Association: Bazar, Clop, Conti, DarkWatchman, EagleEye,
  Hive, Koxic, Polyglot, SysJoker Atomics T1059.003 Test #2 Atomics T1059.003 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(>) OR ">>" OR "&gt;") | regex process="(?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+&gt;"
  | table _time, host, user user, process | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- collection:data staged:local data staging
- defense-evasion:masquerading
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1074.001
- T1036
- T1059.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/

id: '16743.26343'
title: 'Permission Groups Discovery: Local Groups'
description: 'Adversaries may attempt to find local system groups and permission settings.
  The knowledge of local system permission groups can help adversaries determine which
  groups exist and which users belong to a particular group. Adversaries may use this
  information to determine which users have elevated permissions, such as the users
  found within the local administrators group. Atomics T1069.001 Test #3 Atomics T1069.001
  Test #5 Atomics T1069.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(Get-LocalGroup) OR TERM(Get-LocalGroupMember)
  OR (("wmic" OR TERM(Get-WMIObject) AND TERM(group))) | table _time, host, user,
  process, process_*, parent_process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:permission groups discovery
technique_id: 
- T1069
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md#atomic-test-3---permission-groups-discovery-powershell-local

id: '28893.52427'
title: Potential SMB Activity from External IP - Windows
description: Threat actors may scan for hosts with SMB ports exposed to the internet
  and attempt to access services. This rule detects external attempts to access SMB
  shares (Event IDs 5140 or 5145) following network logons (Event ID 4624, Logon Type
  3) within a one minute period correlated by host and user, which may indicate a
  threat actor's initial access attempt via SMB.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12,
  192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) OR (TERM(EventCode=5140) OR
  "EventID>5140<" OR TERM(EventCode=5145) OR "EventID>5145<") | iplocation src_ip
  prefix=geo | where geoCountry!=""| table _time, host, user user, process_name, process_path,
  src_country, src_dns, src_ip, geo_* | bin span=60s | stats values(*) as * by _time,
  host, user | where match(signature_id, "5140|5145") and match(signature_id, "4624") '
techniques:
- initial-access:exploit public-facing application
technique_id: 
- T1190
data_category:
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login/
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html

name: Powershell Get LocalGroup Discovery with Script Block Logging
id: d7c6ad22-155c-11ec-bb64-acde48001122
version: 11
creation_date: '2021-09-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the PowerShell cmdlet `get-localgroup` using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, providing detailed visibility into script execution. Monitoring this activity is significant as it can indicate an attempt to enumerate local groups, which may be a precursor to privilege escalation or lateral movement. If confirmed malicious, an attacker could gain insights into group memberships, potentially leading to unauthorized access or privilege abuse. Review parallel processes and the entire script block for comprehensive analysis.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_get_localgroup_discovery_with_script_block_logging_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may be present. Tune as needed.
references:
    - https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '18093.30601'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(/i) OR TERM(install))
  ".msi" | where match(process, "(?i)\w+tps?://\S+\.msi") | table _time, host, user
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

name: Remote Process Instantiation via WMI and PowerShell Script Block
id: 2a048c14-4634-11ec-a618-3e22fbd008af
version: 12
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Invoke-WmiMethod` commandlet with parameters used to start a process on a remote endpoint via WMI, leveraging PowerShell Script Block Logging (EventCode=4104). This method identifies specific script block text patterns associated with remote process instantiation. This activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
finding:
    title: A process was started on a remote endpoint from $dest$ by abusing WMI using PowerShell.exe
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: SAP NetWeaver Visual Composer Exploitation Attempt
id: a583b9f1-9c3a-4402-9441-b981654dea6c
version: 5
creation_date: '2025-04-28'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: |-
    Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer.
    This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise.
    The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation.
    Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources.
    Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web.Web WHERE

    Web.url IN (
        "*/ctc/CTCWebService/CTCWebServiceBean",
        "*/CTCWebService/CTCWebServiceBean",
        "*/VisualComposer/services/DesignTimeService"
    )
    Web.http_method IN ("HEAD", "POST")
    Web.status=200

    BY Web.src Web.dest Web.http_method
       Web.url Web.http_user_agent Web.url_length

    | `drop_dm_object_name("Web")`

    | eval action=case(
        http_method="HEAD", "Recon/Probe",
        http_method="POST", "Possible Exploitation"
    )

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`

    | table firstTime lastTime src dest http_method
            action url user_agent url_length

    | `sap_netweaver_visual_composer_exploitation_attempt_filter`
how_to_implement: |-
    Ensure that the Web data model is accelerated and populated with web server or web proxy logs capturing HTTP request and response data.
    This search relies on HTTP method, status code, and URL path fields to identify suspicious access patterns against SAP NetWeaver endpoints.
known_false_positives: |-
    Some legitimate administrative activity may access SAP NetWeaver services. However, HEAD or POST requests directly resulting in a 200 OK
    to Visual Composer endpoints are uncommon and should be investigated carefully.
references:
    - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
    - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
    - https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/
analytic_story:
    - SAP NetWeaver Exploitation
asset_type: Web Server
cve:
    - CVE-2025-31324
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Splunk User Enumeration Attempt
id: 25625cb4-1c4d-4463-b0f9-7cb462699cde
version: 9
creation_date: '2022-04-29'
modification_date: '2026-05-14'
author: Lou Stella, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to enumerate usernames in Splunk by detecting multiple failed authentication attempts from the same source. It leverages data from the `_audit` index, specifically focusing on failed authentication events. This activity is significant for a SOC because it can indicate an attacker trying to discover valid usernames, which is a precursor to more targeted attacks like password spraying or brute force attempts. If confirmed malicious, this activity could lead to unauthorized access, compromising the security of the Splunk environment and potentially exposing sensitive data.
data_source:
    - Splunk
search: '`splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`'
how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames.
known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives.
references:
    - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html
finding:
    title: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected.
    entity:
        field: user
        type: user
        score: 40
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Splunk Vulnerabilities
asset_type: Endpoint
cve:
    - CVE-2021-33845
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

name: Unloading AMSI via Reflection
id: a21e3484-c94d-11eb-b55b-acde48001122
version: 13
creation_date: '2021-06-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the tampering of AMSI (Antimalware Scan Interface) via PowerShell reflection. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze suspicious PowerShell commands, specifically those involving `system.management.automation.amsi`. This activity is significant as it indicates an attempt to bypass AMSI, a critical security feature that helps detect and block malicious scripts. If confirmed malicious, this could allow an attacker to execute harmful code undetected, leading to potential system compromise and data exfiltration.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = *system.management.automation.amsi*
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `unloading_amsi_via_reflection_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
references:
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
finding:
    title: Possible AMSI Unloading via Reflection using PowerShell on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Malicious PowerShell
    - Hermetic Wiper
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5454.5611'
title: WebLogic CVE-2017-10271
description: 'A reverse shell is a shell session established on a connection that
  is initiated from a remote machine, not from the local host and in this case the
  session is created using the vulnerability of Weblogic app - wls-wsat Component
  Deserialization - Threat Actor Association: APT29/Nobelium/Cozy Bear -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(powershell) TERM(-w)
  TERM(hidden) TERM(-nop) TERM(-c) TERM(function) TERM(RSC) AND "system.net.sockets.tcpclient"
  AND "cmd.exe" AND "UseShellExecute" AND EventCode=4688 AND "java.exe" | rex field=process
  "\$a\=\''(?<src_ip>(?i)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") | rex field=process
  "\$p\=\''(?<dest_port>(?i)\d{1,5}") | table _time, host, user, process, parent_process_name,
  parent_process_path, src_ip, dest_port, signature_id | bin span=1s | stats values(*)
  as * by _time, host | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
  | iplocation prefix="src_" src_ip| rename src_Country as src_country '
techniques:
- initial-access:exploit public-facing application
- execution:command and scripting interpreter:powershell
technique_id:
- T1190
- T1059.001
data_category:
- Windows event logs
references: null

name: Windows AD Domain Replication ACL Addition
id: 8c372853-f459-4995-afdc-280c114d33ab
version: 14
creation_date: '2022-11-17'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic detects the addition of permissions required for a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from the Windows Security Event Log to identify when these permissions are granted. This activity is significant because it indicates potential preparation for a DCSync attack, which can be used to replicate AD objects and exfiltrate sensitive data. If confirmed malicious, an attacker could gain extensive access to Active Directory, leading to severe data breaches and privilege escalation.
data_source:
    - Windows Event Log Security 5136
search: |-
    `wineventlog_security` EventCode=5136 ObjectClass=domainDNS
      | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType
          BY ObjectClass ObjectDN OpCorrelationID
          src_user SubjectLogonId dest
      | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
      | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
      | mvexpand new_ace
      | where NOT new_ace IN (old_values)
      | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
      | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c")
      | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
      | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
      | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
      | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value
      | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value
      | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
      | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
      | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
      | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId
          BY ObjectClass ObjectDN src_user dest user
      | search (aceControlAccessRights="Replicating Directory Changes" AND aceControlAccessRights="Replicating Directory Changes All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
      | `windows_ad_domain_replication_acl_addition_filter`
how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties` applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username. Ensure your identities lookup is configured with the sAMAccountName and objectSid of all AD user and computer objects.
known_false_positives: When there is a change to nTSecurityDescriptor, Windows logs the entire ACL with the newly added components. If existing accounts are present with this permission, they will raise an alert each time the nTSecurityDescriptor is updated unless whitelisted.
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
    - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
finding:
    title: $src_user$ has granted $user$ permission to replicate AD objects
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: $src_user$ has granted $user$ permission to replicate AD objects
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint