Splunk rules: 2f

name: Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt
id: 66f22f52-fbae-4be7-a263-561dacb63612
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: Anomaly
description: |
    This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709)
    | fillnull
    | stats min(_time) as firstTime max(_time) as lastTime
            by src dest dest_port transport signature_id signature class_desc MitreAttackGroups rule InlineResult InlineResultReason app
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___lumma_stealer_outbound_connection_attempt_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be unlikely.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Lumma Stealer Outbound Connection Attempt detected on host $dest$ origniating from $src$
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Lumma Stealer
asset_type: Network
mitre_attack_id:
    - T1041
    - T1573.002
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

name: Esentutl SAM Copy
id: d372f928-ce4f-11eb-a762-acde48001122
version: 10
creation_date: '2021-08-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the use of `esentutl.exe` to access credentials stored in the ntds.dit or SAM file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it may indicate an attempt to extract sensitive credential information, which is a common tactic in lateral movement and privilege escalation. If confirmed malicious, this could allow an attacker to gain unauthorized access to user credentials, potentially compromising the entire network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
    Processes.process IN ("*ntds*", "*SAM*")
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `esentutl_sam_copy_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited. Filter as needed.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
    - https://attack.mitre.org/software/S0404/
analytic_story:
    - Credential Dumping
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Excessive number of service control start as disabled
id: 77592bec-d5cc-11eb-9e60-acde48001122
version: 13
creation_date: '2021-06-25'
modification_date: '2026-05-13'
author: Michael Hart, Splunk
status: production
type: Anomaly
description: The following analytic detects an excessive number of `sc.exe` processes launched with the command line argument `start= disabled` within a short period. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and process GUIDs. This activity is significant as it may indicate an attempt to disable critical services, potentially impairing system defenses. If confirmed malicious, this behavior could allow an attacker to disrupt security mechanisms, hinder incident response, and maintain control over the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "sc.exe"
        AND
        Processes.process="*start= disabled*"
      BY Processes.dest Processes.user Processes.parent_process
         Processes.process_name Processes.parent_process_id, _time
         span=30m
    | where distinct_cmdlines >= 8
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_number_of_service_control_start_as_disabled_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate programs and administrators will execute sc.exe with the start disabled flag.  It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time.
references:
    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
    - https://attack.mitre.org/techniques/T1562/001/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35400.62242'
title: File Executed from INetCache
description: Adversaries may transfer tools or other files from an external system
  into a compromised environment. Tools or files may be copied from an external adversary-controlled
  system to the victim network through the command and control channel or through
  alternate protocols such as ftp. Once present, adversaries may also transfer/spread
  tools between victim devices within a compromised environment (i.e. Lateral Tool
  Transfer). This use case detects when a file was executed from the C:\Users\<user>\AppData\Local\Microsoft\Windows\INetCache\IE
  folder.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE" | regex process_path="(?i)\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5cINetCache\x5cIE"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ngen/
- https://learn.microsoft.com/en-us/dotnet/framework/tools/ngen-exe-native-image-generator
- https://attack.mitre.org/techniques/T1105/
- https://www.elastic.co/guide/en/security/8.14/suspicious-execution-from-inet-cache.html

id: '6029.6450'
title: High Entropy Powershell
description: 'There are many tools that assist in obfuscating powershell executions
  such as Base64 encoding. Other methods include using tools like Chimera, which is
  a PowerShell obfuscation script designed to bypass AMSI and antivirus solutions.
  It digests malicious PS1''s known to trigger AV and uses string substitution and
  variable concatenation to evade common detection signatures. This use case uses
  Splunks URL Toolbox to find high entropy powershell commands. -- Software Association:
  BianLian'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) |
  eval process_path=Path |`ut_shannon(process)` | table _time, host, user process,
  process_*, signature_id, ut_* | bin span=1s | stats values(*) as * by _time, host
  |eventstats avg(ut_shannon) as avg_ut by host, process_path, _time|where avg_ut
  > 5 '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- Process command-line parameters
- PowerShell logs
references:
- https://github.com/tokyoneon/Chimera

name: Linux At Application Execution
id: bf0a378e-5f3c-11ec-a6de-acde48001122
version: 13
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("at", "atd")
        OR
        Processes.parent_process_name IN ("at", "atd")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_at_application_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1053/001/
    - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: At application was executed on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Scheduled Tasks
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
atomic_guid:
    - 9ddf2e5e-7e2c-46c2-9940-3c2ff29c7213
mitre_attack_id:
    - T1053.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Doas Conf File Creation
id: f6343e86-6e09-11ec-9376-acde48001122
version: 11
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of the doas.conf file on a Linux host. This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo. The detection leverages filesystem data from the Endpoint data model, focusing on the creation of the doas.conf file. This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root privileges, leading to full system compromise.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path IN ("*/etc/doas.conf")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_doas_conf_file_creation_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://wiki.gentoo.org/wiki/Doas
    - https://www.makeuseof.com/how-to-install-and-use-doas/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file $file_name$ is created in $file_path$ on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Root Execution of id
id: 538dc501-ce3a-4a32-9f56-6dbe0aee1474
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt.
    This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise.
    If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_path="/usr/bin/id"
    Processes.user="root"

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_root_execution_of_id_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Execution of [$process_path$] by [$user$] on [$dest$]
        - field: user
          type: user
          score: 20
          message: Execution of [$process_path$] by [$user$] on [$dest$]
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Post-Exploitation
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Network Discovery Using Route Windows App
id: dd83407e-439f-11ec-ab8e-acde48001122
version: 10
creation_date: '2021-11-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the `route.exe` Windows application, commonly used for network discovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because adversaries often use `route.exe` to map network routes and identify potential targets within a network. If confirmed malicious, this behavior could allow attackers to gain insights into network topology, facilitating lateral movement and further exploitation. Note that false positives may occur due to legitimate administrative tasks or automated scripts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `network_discovery_using_route_windows_app_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. Filter as needed.
references:
    - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
analytic_story:
    - Active Directory Discovery
    - Qakbot
    - CISA AA22-277A
    - Windows Post-Exploitation
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1016.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '24645.45565'
title: Potential Proxy Malware via AutoRun Key
description: The Windows Registry Run keys can be abused to establish persistence
  for malware known as SystemBC (aka Coroxy or DroxiDat), which functions as a proxy,
  bot, backdoor, and RAT. Threat actors utilize this method to maintain continuous
  access to a compromised system, enabling them to gather information, execute commands,
  and deploy additional malware. SystemBC has been observed modifying AutoRun keys
  with a value of socks5. This use case detects modifications to registry keys containing
  the path \SOFTWARE\Microsoft\Windows\CurrentVersion\Run including the value "socks5".
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "socks5" | table _time, host, user signature_id, process, process_*, user, parent_process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
- T1547.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/

name: Revil Common Exec Parameter
id: 85facebe-c382-11eb-9c3e-acde48001122
version: 12
creation_date: '2021-06-04'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of command-line parameters commonly associated with REVIL ransomware, such as "-nolan", "-nolocal", "-fast", and "-full". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs mapped to the `Processes` node of the `Endpoint` data model. This activity is significant because these parameters are indicative of ransomware attempting to encrypt files on a compromised machine. If confirmed malicious, this could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "* -nolan *"
        OR
        Processes.process = "* -nolocal *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `revil_common_exec_parameter_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: third party tool may have same command line parameters as revil ransomware.
references:
    - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
finding:
    title: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$
analytic_story:
    - Ransomware
    - Revil Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 Control RunDLL Hunt
id: c8e7ced0-10c5-11ec-8b03-acde48001122
version: 10
creation_date: '2021-09-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies instances of rundll32.exe executing with `Control_RunDLL` in the command line, which is indicative of loading a .cpl or other file types. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as rundll32.exe can be exploited to execute malicious Control Panel Item files, potentially linked to CVE-2021-40444. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32` Processes.process=*Control_RunDLL*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `rundll32_control_rundll_hunt_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
references:
    - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
    - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
    - https://attack.mitre.org/techniques/T1218/011/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
    - https://redcanary.com/blog/intelligence-insights-december-2021/
analytic_story:
    - Suspicious Rundll32 Activity
    - Microsoft MSHTML Remote Code Execution CVE-2021-40444
    - Living Off The Land
asset_type: Endpoint
cve:
    - CVE-2021-40444
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1070.1105'
title: SSH Pivoting
description: 'This use case is searching for specific keywords that are generated
  when SSH pivoting is made - Threat Actor Association: Daixin Team, Lightbasin /
  UNC1945, TeamTNT'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (TERM(type=USER_START) OR TERM(type=USER_END))
  "sshd" "addr" "success" | rename process as process_name, ses as session_id, addr
  as src_ip, hostname as src_host| eval user=mvappend("",acct,user,auid,uid), user=mvfilter(NOT
  match(user,"\?|\(unknown\)|^\d+$|unset|^\s$|^$")), user_id=mvappend("",auid,uid),
  user_id=mvfilter(match(user_id,"^\d+$")), start_time=if(type="USER_START",floor(_time),start_time),
  end_time=if(type="USER_END",ceiling(_time),end_time) | table _time, host, user src_ip,
  src_host, end_time, process_*, session_id, start_time, user, user_id | stats values(*)
  as *, earliest(_time) as _time, earliest(user) as initial_user by host, session_id,
  src_ip | eventstats dc(src_ip) as dc_src_ip, dc(initial_user) as dc_user_by_host,
  dc(session_id) as dc_session_by_host by host| eventstats dc(host) as dc_host, dc(initial_user)
  as dc_user_by_ip, dc(session_id) as dc_session_by_ip by src_ip| lookup dnslookup
  clientip as src_ip OUTPUT clienthost as src_dns| eval src_host=coalesce(src_dns,
  src_host), end_time=if(isnull(end_time), 0, end_time)| eval session_duration=end_time-start_time|
  where (session_duration>1 or session_duration<0) and dc_src_ip>0 and dc_user_by_host>0
  and dc_host>0 and dc_user_by_ip>0 and dc_session_by_host>0 and dc_session_by_ip>0|
  eval session_duration=if(session_duration<0, "potentially active", session_duration."
  second") '
techniques:
- lateral-movement:remote services:ssh
technique_id:
- T1021.004
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://attack.mitre.org/techniques/T1021/004/

id: '28096.51137'
title: Temporary ConnectWise xml File Activity
description: ConnectWise ScreenConnect is a popular remote desktop solution. ConnectWise
  released an advisory detailing a critical authentication bypass vulnerability affecting
  ScreenConnect versions prior to 23.9.8. This use case detects when an XML file in
  the \Temp\ScreenConnect\[version number]\ directory has been created, modified,
  or deleted. To enable detection of the file activities associated with the vulnerability,
  configure the Advanced Auditing policy to log successful Windows Event ID 4663 events,
  and set a System Access Control List (SACL) on the target directory to monitor file
  modifications. See Huntress article in references for detailed information.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") "C:\\Windows\\Temp\\ScreenConnect\\" ".xml" | regex ObjectName="(?i)C:\x5cWindows\x5cTemp\x5c\ScreenConnect\x5c.+\.xml"
  | table _time, host, user, process, process_*, ObjectName | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- persistence:external remote services
- command-and-control:remote access software
- initial-access:external remote services
technique_id: 
- T1133
- T1219
data_category:
- File monitoring
- Windows event logs
references:
- https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
- https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8

name: Windows Account Discovery With NetUser PreauthNotRequire
id: cf056b65-44b2-4d32-9172-d6b6f081a376
version: 9
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser with the -PreauthNotRequire parameter, leveraging Event ID 4104. This method identifies attempts to query Active Directory user accounts that do not require Kerberos preauthentication. Monitoring this activity is crucial as it can indicate reconnaissance efforts by an attacker to identify potentially vulnerable accounts. If confirmed malicious, this behavior could lead to further exploitation, such as unauthorized access or privilege escalation within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText = "*-PreauthNotRequire*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_account_discovery_with_netuser_preauthnotrequire_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
analytic_story:
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Exfiltration Over C2 Via Invoke RestMethod
id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba
version: 14
creation_date: '2023-04-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText = "* Post *" AND ScriptBlockText = "* -InFile *"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives should be limited. Filter as needed.
references:
    - https://twitter.com/_CERT_UA/status/1620781684257091584
    - https://cert.gov.ua/article/3761104
finding:
    title: A PowerShell script on $dest$ is attempting to transfer files to a remote URL.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Microsoft WSUS CVE-2025-59287
    - Hellcat Ransomware
    - APT37 Rustonotto and FadeStealer
    - Winter Vivern
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1041
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Important Audit Policy Disabled
id: 1bf500e5-1226-41d9-af5d-ed1f577929f2
version: 8
creation_date: '2025-02-19'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: The following analytic detects the disabling of important audit policies. It leverages EventCode 4719 from Windows Security Event Logs to identify changes where success or failure auditing is removed. This activity is significant as it suggests an attacker may have gained access to the domain controller and is attempting to evade detection by tampering with audit policies. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.
data_source:
    - Windows Event Log Security 4719
search: |-
    `wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) `important_audit_policy_subcategory_guids`
      | replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, %%8450" with "Success removed, Failure removed" in AuditPolicyChanges
      | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID)
      | rename ClientProcessId as process_id
      | stats min(_time) as _time values(host) as dest
        BY AuditPolicyChanges SubcategoryGuid, process_id
      | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory
      | `windows_important_audit_policy_disabled_filter`
how_to_implement: To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode `4719` from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719
finding:
    title: Important audit policy "$SubCategory$" of category "$Category$" was disabled on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Audit Policy Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Large Number of Computer Service Tickets Requested
id: 386ad394-c9a7-4b4f-b66f-586252de20f0
version: 12
creation_date: '2023-03-21'
modification_date: '2026-07-05'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window.
    It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance.
    If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
    | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0)
    | search NOT TargetUserName="*$"
    | bucket span=5m _time
    | stats dc(ServiceName) AS unique_targets
            values(ServiceName) as host_targets
            values(dest) as dest
      by _time, IpAddress, TargetUserName
    | where unique_targets > 30
    | `windows_large_number_of_computer_service_tickets_requested_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
references:
    - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
    - https://attack.mitre.org/techniques/T1135/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
intermediate_findings:
    entities:
        - field: IpAddress
          type: system
          score: 20
          message: A large number of kerberos computer service tickets were requested by $IpAddress$ within 5 minutes.
analytic_story:
    - Active Directory Privilege Escalation
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1135
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Regedit Silent Reg Import
id: 824dd598-71be-4203-bc3b-024f4cda340e
version: 11
creation_date: '2022-07-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of the Windows registry using the regedit.exe application with the silent mode parameter. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because the silent mode allows registry changes without user confirmation, which can be exploited by adversaries to import malicious registry settings. If confirmed malicious, this could enable attackers to persist in the environment, escalate privileges, or manipulate system configurations, leading to potential system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="regedit.exe"
            OR
            Processes.original_file_name="regedit.exe"
        )
        AND Processes.process="* /s *" AND Processes.process="*.reg*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_modify_registry_regedit_silent_reg_import_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may execute this command that may cause some false positive. Filter as needed.
references:
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
    - https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The regedit app was executed with silet mode parameter to import .reg file on $dest$.
analytic_story:
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Office Product Spawned Uncommon Process
id: 55d8741c-fa32-4692-8109-410304961eb8
version: 9
creation_date: '2025-01-14'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    `process_office_products_parent`
    AND
    (
      Processes.process_name IN (
        bitsadmin.exe,
        certutil.exe,
        cmd.exe,
        cscript.exe,
        mshta.exe,
        powershell.exe,
        pwsh.exe,
        regsvr32.exe,
        rundll32.exe,
        wmic.exe,
        wscript.exe
      )
      OR
      Processes.original_file_name IN (
        bitsadmin.exe,
        CertUtil.exe,
        Cmd.Exe,
        cscript.exe,
        MSHTA.EXE,
        PowerShell.EXE,
        pwsh.dll,
        REGSVR32.EXE,
        RUNDLL32.EXE,
        wmic.exe,
        wscript.exe
      )
    )
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_office_product_spawned_uncommon_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, however filter as needed.
references:
    - https://any.run/malware-trends/trickbot
    - https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
    - https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
    - https://attack.mitre.org/techniques/T1047/
    - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
    - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
    - https://redcanary.com/threat-detection-report/threats/TA551/
    - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
    - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
    - https://www.joesandbox.com/analysis/380662/0/html
    - https://www.joesandbox.com/analysis/702680/0/html
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
finding:
    title: User $user$ on $dest$ spawned Windows Script Host from Winword.exe
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - AgentTesla
    - Azorult
    - Compromised Windows Host
    - CVE-2023-21716 Word RTF Heap Corruption
    - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
    - DarkCrystal RAT
    - FIN7
    - IcedID
    - NjRAT
    - PlugX
    - Qakbot
    - Remcos
    - Spearphishing Attachments
    - Trickbot
    - Warzone RAT
    - APT37 Rustonotto and FadeStealer
    - MuddyWater
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint