Splunk rules: 2g

id: '6143.6641'
title: Adfind Execution
description: 'AdFind is a free command-line query tool that can be used for gathering
  information from Active Directory. This use case looks for process executions of
  Adfind. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT31, BlackMatter,
  Conti, DarkSide, FIN6, FIN7, FIN12, Karakurt, Lazarus, Traveling Spider, Wizard
  Spider, Yanluowang - Software Association: ALPHV/BlackCat, BazarLoader, Conti, Dridex,
  Entropy, Lockbit, Nefilim, Quantum, Sodinokibi/REvil - Atomics T1016 Test #6 Atomics
  T1018 Test#10 Atomics T1018 Test#11 Atomics T1069.002 Test #8 Atomics T1087.002
  Test #5 Atomics T1087.002 Test #6 Atomics T1087.002 Test #7 Atomics T1087.002 Test
  #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104) OR TERM(<EventID>4103<) OR TERM(<EventID>4104<)) "adfind" |
  table _time, host, user user, process, process_name | bin span=5s | stats values(*)
  as * by _time, host | where event_count > 0 '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:domain trust discovery
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1087.002
- T1069.002
- T1482
- T1016
- T1018
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

name: ASL AWS IAM AccessDenied Discovery Events
id: a4f39755-b1e2-40bb-b2dc-4449c45b0bf2
version: 7
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. It leverages AWS CloudTrail logs to detect multiple failed access attempts from the same source IP and user identity. This activity is significant as it may indicate that an access key has been compromised and is being misused for unauthorized discovery actions. If confirmed malicious, this could allow attackers to gather information about the AWS environment, potentially leading to further exploitation or privilege escalation.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.response.error=AccessDenied OR api.response.error=OperationNotPermittedException OR api.response.error=*Unauthorized* actor.user.type=IAMUser
      | bucket _time span=1h
      | stats count as failures min(_time) as firstTime max(_time) as lastTime dc(api.operation) as dc_operation, dc(api.service.name) as dc_service values(api.operation) as api.operation values(api.service.name) as api.service.name values(http_request.user_agent) as http_request.user_agent values(src_endpoint.ip) as src_ip values(actor.user.account.uid) as actor.user.account.uid values(cloud.provider) as cloud.provider values(cloud.region) as cloud.region
        BY _time actor.user.uid
      | where failures >= 5 AND dc_operation >= 1 AND dc_service >= 1
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_iam_accessdenied_discovery_events_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
references:
    - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Suspicious Cloud User Activities
asset_type: AWS Account
mitre_attack_id:
    - T1580
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Azure AD Admin Consent Bypassed by Service Principal
id: 9d4fea43-9182-4c5a-ada8-13701fd5615d
version: 12
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a service principal in Azure Active Directory assigns app roles without standard admin consent. It uses Entra ID logs from the `azure_monitor_aad` data source, focusing on the "Add app role assignment to service principal" operation. This detection is significant as it highlights potential bypasses of critical administrative consent processes, which could lead to unauthorized privileges being granted. If confirmed malicious, this activity could allow attackers to exploit automation to assign sensitive permissions without proper oversight, potentially compromising the security of the Azure AD environment.
data_source:
    - Azure Active Directory Add app role assignment to service principal
search: "`azure_monitor_aad` (operationName=\"Add app role assignment to service principal\" OR operationName=\"Add member to role*\") src_user_type=servicePrincipal | rename properties.* as * | eval roleId = mvindex('targetResources{}.modifiedProperties{}.newValue',0) | eval roleValue = mvindex('targetResources{}.modifiedProperties{}.newValue',1) | eval roleDescription = mvindex('targetResources{}.modifiedProperties{}.newValue',2) | eval user_id = mvindex('targetResources{}.id', 0), user=coalesce(user,mvindex('targetResources{}.displayName',0)) | rename initiatedBy.app.displayName as src_user, userAgent as user_agent | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product src_user user_id roleId roleValue roleDescription user_agent signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_admin_consent_bypassed_by_service_principal_filter`"
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlog log category
known_false_positives: Service Principals are sometimes configured to legitimately bypass the consent process for purposes of automation. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/003/
finding:
    title: Service principal $src_user$ bypassed the admin consent process and granted permissions to $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 50
          message: Service principal $src_user$ bypassed the admin consent process and granted permissions to $user$
analytic_story:
    - Azure Active Directory Privilege Escalation
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure AD AzureHound UserAgent Detected
id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3
version: 9
creation_date: '2025-01-05'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory environments, often employed by security professionals for legitimate auditing purposes. However, it can also be leveraged by malicious actors to perform reconnaissance activities, mapping out the Azure AD infrastructure to identify potential vulnerabilities and targets for further exploitation. Detecting its usage can help in identifying unauthorized access attempts and preemptively mitigating potential security threats to your Azure environment.
data_source:
    - Azure Active Directory NonInteractiveUserSignInLogs
    - Azure Active Directory MicrosoftGraphActivityLogs
search: |-
    `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs, NonInteractiveUserSignInLogs) properties.userAgent=azurehound*
      | rename properties.userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           signature
      | iplocation src
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_azurehound_useragent_detected_filter`
how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest NonInteractiveUserSignInLogs and MicrosoftGraphActivityLogs via an Azure EventHub. See reference for links for further details.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/SpecterOps/AzureHound
    - https://splunkbase.splunk.com/app/3110
    - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Install/
finding:
    title: AzureHound UserAgent String $user_agent$ Detected on Tenant $dest$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Compromised User Account
asset_type: Azure Tenant
mitre_attack_id:
    - T1087.004
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco NVM - Suspicious File Download via Headless Browser
id: cd0e816f-f67d-4dbe-a153-480b546e867e
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument.
    This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms.
    The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow.
    Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`

     ``` Usually the initiator of the connection is the child process, meaning the parent will contain the suspicious command.```

     (
       parent_process_name IN ("brave.exe", "chrome.exe", "msedge.exe", "opera.exe", "vivaldi.exe")
       OR
       process_name IN ("brave.exe", "chrome.exe", "msedge.exe", "opera.exe", "vivaldi.exe")
     )
     (
       (parent_process_arguments="*--headless*" parent_process_arguments="*--dump-dom*")
       OR
       (process_arguments="*--headless*" process_arguments="*--dump-dom*")
     )
     NOT dest IN (
             "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
             "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
             "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
             "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
             "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
             )

     ``` In order to avoid matching with any public IP, we extract the IP value from the CommandLine and filter on it```

     | rex field=parent_process_arguments "(?i)\\b(?:https?|ftp)://(?<extracted_ip_parent>(?:\\d{1,3}\\.){3}\\d{1,3})"
     | rex field=process_arguments "(?i)\\b(?:https?|ftp)://(?<extracted_ip_child>(?:\\d{1,3}\\.){3}\\d{1,3})"
     | eval direct_ip_match=if(dest == extracted_ip_child, 1, if(dest == extracted_ip_parent, 1, 0))

     | where (
         dest_hostname IN (
             "*.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*",
             "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*",
             "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*",
             "*paste.ee*", "*pastebin.*", "*pastetext.net*", "*privatlab.*",
             "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*",
             "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*",
             "*ufile.io*", "*w3spaces.com*", "*workers.dev*"
         )
         OR direct_ip_match = 1
       )

     | stats count min(_time) as firstTime max(_time) as lastTime
             values(parent_process_arguments) as parent_process_arguments
             values(process_arguments) as process_arguments
             values(parent_process_hash) as parent_process_hash
             values(process_hash) as process_hash
             values(module_name_list) as module_name_list
             values(module_hash_list) as module_hash_list
             values(dest_port) as dest_port
             values(aliul) as additional_logged_in_users_list
             values(dest_hostname) as dest_hostname
             by src dest parent_process_path parent_process_name parent_process_integrity_level process_path process_name process_integrity_level process_id transport
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | table
       parent_process_integrity_level parent_process_path parent_process_name parent_process_arguments parent_process_hash
       process_integrity_level process_path process_name process_arguments process_hash process_id
       additional_logged_in_users_list module_name_list module_hash_list
       src dest_hostname dest dest_port transport firstTime lastTime
     | `cisco_nvm___suspicious_file_download_via_headless_browser_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages.
    These tools may occasionally download legitimate resources as part of their normal behavior.
    Tuning based on command-line patterns or known dest hostnames may be required to avoid noise.
references:
    - https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf
    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
    - https://x.com/mrd0x/status/1478234484881436672?s=12
    - https://developer.chrome.com/docs/chromium/headless
finding:
    title: Suspicious file download using the Chromium-based browser $parent_process_name$ via the commandline $process_arguments$. Observed on host $src$ communicating with $dest$ / $dest_hostname$
    entity:
        field: src
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1105
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1048.1079'
title: Linux Enumeration Techniques
description: 'Once the attacker has a limited shell it is useful to escalate that
  shell''s privileges. In order to find all kind of information about the system and
  find a way to escalate, the attacker uses multiple scripts that will output information
  like kernel information, current user/group info, users that have previously logged
  onto the system, group memberships, admin users, contents of /etc/passwd, sudo commands
  without password, environment information, cron jobs, network and ip information,
  running processes, interesting files (SUIG, SGID), bash_history etc. Threat Actor
  Association: Watch Dog'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type IN ("CRED_ACQ", "USER_ACCT",
  "CRED_DISP", "USER_END", "USER_START", "CRED_REFR", "USER_CMD") op IN ("PAM:setcred",
  "PAM:accounting", "PAM:session_close", "PAM:session_open") grantors IN ("pam_env",
  "pam_keyinit", "pam_access", "pam_unix") exe IN ("/usr/bin/crontab", "/usr/bin/sudo")
  terminal IN ("cron", "/dev/pts*")) OR (bash_command="*.sh*") OR ((COMMAND IN ("/bin/id",
  "list", "/usr/bin/id") TTY="pts*")) OR process="crontab" | table _time, host, user,
  process, process_*, TTY, auid, op, grantors, terminal, type, acct | bin span=60s
  | stats values(*) as * by _time, host | where ((process like "%/bin/id%" OR process
  like "%list%") AND TTY like "%pts%" AND (type like "%CRED_ACQ%" OR type like "%USER_ACCT%"
  OR type like "%CRED_DISP%" OR type like "%USER_END%" OR type like "%USER_START%"
  OR type like "%CRED_REFR%" OR type like "%USER_CMD%") AND (op like "%PAM:setcred%"
  OR op like "%PAM:accounting%" OR op like "%PAM:session_close%" OR op like "%PAM:session_open%")
  AND (grantors like "%pam_env" OR grantors like "%pam_keyinit%" OR grantors like
  "%pam_access%" OR grantors like "%pam_unix%") AND (process_path like "%/usr/bin/crontab%"
  OR process_path like "%/usr/bin/sudo%") AND (terminal like "%cron%" OR terminal
  like "%/dev/pts%") AND process like "%.sh%") OR ((process like "%list%" OR process
  like "%/usr/bin/id%") AND TTY like "%pts%" AND process like "%crontab%" AND process
  like "%.sh%") '
techniques:
- execution:command and scripting interpreter:unix shell
- discovery:account discovery
- discovery:file and directory discovery
- discovery:permission groups discovery
- discovery:system information discovery
- discovery:system network configuration discovery
- discovery:system network connections discovery
- discovery:system owner/user discovery
- collection:automated collection
technique_id:
- T1059.004
- T1087
- T1083
- T1069
- T1082
- T1016
- T1049
- T1033
- T1119
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh

name: PaperCut NG Remote Web Access Attempt
id: 9fcb214a-dc42-4ce7-a650-f1d2cab16a6a
version: 10
creation_date: '2023-05-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects potential exploitation attempts on publicly accessible PaperCut NG servers.
    It identifies connections from public IP addresses to the server, specifically monitoring URI paths commonly used in proof-of-concept scripts for exploiting PaperCut NG vulnerabilities.
    This detection leverages web traffic data from the `Web` datamodel, focusing on specific URI paths and excluding internal IP ranges.
    This activity is significant as it may indicate an attempt to exploit known vulnerabilities in PaperCut NG, potentially leading to unauthorized access or control of the server.
    If confirmed malicious, attackers could gain administrative access, leading to data breaches or further network compromise.
data_source:
    - Suricata
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Web WHERE

    Web.url IN (
      "*/app?service=direct/1/PrinterDetails/printerOptionsTab.tab"
      "*/app?service=direct/1/PrinterList/selectPrinter&sp=*",
      "*/app?service=page/PrinterList",
      "*/app?service=page/SetupCompleted"
    )
    NOT src IN (
                  "10.0.0.0/8",
                  "172.16.0.0/12",
                  "192.168.0.0/16",
                  "100.64.0.0/10",
                  "127.0.0.0/8",
                  "169.254.0.0/16",
                  "192.0.0.0/24",
                  "192.0.0.0/29",
                  "192.0.0.8/32",
                  "192.0.0.9/32",
                  "192.0.0.10/32",
                  "192.0.0.170/32",
                  "192.0.0.171/32",
                  "192.0.2.0/24",
                  "192.31.196.0/24",
                  "192.52.193.0/24",
                  "192.88.99.0/24",
                  "224.0.0.0/4",
                  "192.175.48.0/24",
                  "198.18.0.0/15",
                  "198.51.100.0/24",
                  "203.0.113.0/24",
                  "240.0.0.0/4",
                  "::1"
                )
    by Web.http_user_agent Web.http_method
       Web.url,Web.url_length Web.src
       Web.dest Web.dest_port

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `papercut_ng_remote_web_access_attempt_filter`
how_to_implement: |-
    To successfully implement this search you need to be ingesting information on Web traffic that include fields relevant for traffic into the `Web` datamodel.
known_false_positives: |-
    False positives may be present if you allow access to the PaperCut NG server from public IP addresses. Filter as needed.
references:
    - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
    - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
    - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
    - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
    - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
finding:
    title: URIs specific to PaperCut NG have been access by a public IP $src$ against $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - PaperCut MF NG Vulnerability
asset_type: Web Server
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '5383.5493'
title: Pass-the-Hash
description: Detect when pass-the-hash techniques are utilized with computer or user
  accounts as in the most notable ZeroLogon exploit scenario after a computer account
  password has been reset.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR
  "<EventID>4624<") Logon_Type=3 Authentication_Package=NTLM) | regex user="\$$" |
  rex field=_raw "Account Name:\s+(?<user>\S+\$)" | table _time, host, user signature_id,
  src_ip, Authentication_Package | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:use alternate authentication material:pass the hash
technique_id:
- T1550.002
data_category:
- Windows event logs
references:
- https://www.cyberark.com/resources/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer
- https://www.binarydefense.com/reliably-detecting-pass-the-hash/

name: Powershell Remote Thread To Known Windows Process
id: ec102cb2-a0f5-11eb-9b38-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-07-01'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |-
    The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread.
    It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others.
    This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware.
    If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
data_source:
    - Sysmon EventID 8
search: |-
    `sysmon`
    EventCode=8
    SourceImage IN (
        "*\\powershell_ise.exe",
        "*\\powershell.exe",
        "*\\pwsh.exe"
    )
    TargetImage IN (
        "*\\csrss.exe",
        "*\\explorer.exe",
        "*\\gpupdate.exe",
        "*\\services.exe",
        "*\\smss.exe",
        "*\\spoolsv.exe",
        "*\\svchost.exe",
        "*\\taskhost.exe",
        "*\\userinit.exe",
        "*\\wininit.exe",
        "*\\winlogon.exe"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(NewThreadId) as "NewThreadId"
                  values(StartAddress) as "StartAddress"
      by dest signature_id signature
         SourceProcessGuid SourceProcessId SourceImage
         TargetProcessGuid TargetProcessId TargetImage
         StartModule StartFunction vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_remote_thread_to_known_windows_process_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
finding:
    title: A suspicious powershell process $SourceImage$ created a remote thread into the target process $TargetImage$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: SourceImage
      type: process_name
    - field: TargetImage
      type: process_name
analytic_story:
    - Trickbot
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Powershell Using memory As Backing Store
id: c396a0c4-c9f2-11eb-b4f5-acde48001122
version: 14
creation_date: '2021-06-14'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious PowerShell script execution using memory streams as a backing store, identified via EventCode 4104. It leverages PowerShell Script Block Logging to capture scripts that create new objects with memory streams, often used to decompress and execute payloads in memory. This activity is significant as it indicates potential in-memory execution of malicious code, bypassing traditional file-based detection. If confirmed malicious, this technique could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges without leaving a trace on the disk.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = *New-Object* ScriptBlockText = *IO.MemoryStream*
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_using_memory_as_backing_store_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: powershell may used this function to store out object into memory.
references:
    - https://web.archive.org/web/20201112031711/https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
finding:
    title: A PowerShell script contains memorystream command on host $dest$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A PowerShell script contains memorystream command on host $dest$.
analytic_story:
    - Data Destruction
    - MoonPeak
    - Medusa Ransomware
    - Hermetic Wiper
    - IcedID
    - Malicious PowerShell
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Process Executed From Container File
id: d8120352-3b62-411c-8cb6-7b47584dd5e8
version: 12
creation_date: '2023-07-11'
modification_date: '2026-07-09'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common technique used by adversaries to execute scripts or evade defenses. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
    count
    min(_time) as firstTime
    max(_time) as lastTime
    from datamodel=Endpoint.Processes
    where Processes.process IN (
        "*.ZIP\\*",
        "*.ISO\\*",
        "*.IMG\\*",
        "*.CAB\\*",
        "*.TAR\\*",
        "*.GZ\\*",
        "*.RAR\\*",
        "*.7Z\\*"
        )
        AND Processes.action="allowed"
    by
        Processes.action
        Processes.dest
        Processes.original_file_name
        Processes.parent_process
        Processes.parent_process_exec
        Processes.parent_process_guid
        Processes.parent_process_id
        Processes.parent_process_name
        Processes.parent_process_path
        Processes.process
        Processes.process_exec
        Processes.process_guid
        Processes.process_hash
        Processes.process_id
        Processes.process_integrity_level
        Processes.process_name
        Processes.process_path
        Processes.user
        Processes.user_id
        Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | regex process="(?i).*\.(zip|iso|img|cab|tar|gz|rar|7z)\\\\.+\.(bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh)\"?$"
    | rex field=process "(?i).+\\\\(?<file_name>[^\\\\]+\.(?:zip|iso|img|cab|tar|gz|rar|7z))\\\\(?:.+\\\\)?(?<container_file_name>[^\\\\\"]+\.(?:bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh))\"?$"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_process_executed_from_container_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Various business process or userland applications and behavior.
references:
    - https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
    - https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/
    - https://attack.mitre.org/techniques/T1204/002/
finding:
    title: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$].
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$].
threat_objects:
    - field: process_name
      type: process_name
    - field: file_name
      type: file_name
    - field: container_file_name
      type: file_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Unusual Processes
    - Amadey
    - Remcos
    - Snake Keylogger
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
    - T1036.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8328.10392'
title: Windows Firewall Rule Creation
description: 'Windows has several utility used to interact with networking components
  on local or remote systems. This use case looks for firewall rules added with netsh
  or New-NetFirewallRule. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT35/Phosphorus/Magic
  Hound, BlackCat, Magnat, TA428, Volt Typhoon -- Software Association: BianLian,
  BlackByte, Black Basta, Insekt, Lockbit, Trigona -- Atomics T1021.001 Test #3 Atomics
  T1021.001 Test #4 Atomics T1562.004 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) New-NetFirewallRule | table _time, host, user, event_id, signature_id,
  process_*, process | rex field=process (?<ioc>"(?i)New-NetFirewallRule.{1,25}")
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify system firewall
technique_id:
- T1562.004
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
- https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)?redirectedfrom=MSDN
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps

name: Windows Gather Victim Network Info Through Ip Check Web Services
id: 70f7c952-0758-46d6-9148-d8969c4481d1
version: 22
creation_date: '2022-06-24'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects processes attempting to connect to known IP check web services. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services like "wtfismyip.com" and "ipinfo.io". This activity is significant as it is commonly used by malware, such as Trickbot, for reconnaissance to determine the infected machine's IP address. If confirmed malicious, this could allow attackers to gather network information, aiding in further attacks or lateral movement within the network.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.*", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*", "*geoip.*", "*icanhazip.*", "*ipwho.is*", "*ifconfig.me*", "*myip.com*", "*ipstack.com*", "*myexternalip.com*", "*ip-api.io*", "*trackip.net*", "*ipgeolocation.io*", "*ipfind.io*", "*freegeoip.app*", "*ipv4bot.whatismyipaddress.com*")
      | stats  min(_time) as firstTime max(_time) as lastTime count
        BY answer answer_count dvc
           process_exec process_guid process_name
           query query_count reply_code_id
           signature signature_id src
           user_id vendor_product QueryName
           QueryResults QueryStatus
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_gather_victim_network_info_through_ip_check_web_services_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
known_false_positives: Filter internet browser application to minimize the false positive of this detection.
references:
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
intermediate_findings:
    entities:
        - field: dvc
          type: system
          score: 20
          message: a network connection on known abused web services from $dvc$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Azorult
    - DarkCrystal RAT
    - Phemedrone Stealer
    - Snake Keylogger
    - Handala Wiper
    - PXA Stealer
    - Meduza Stealer
    - Water Gamayun
    - Quasar RAT
    - 0bj3ctivity Stealer
    - Castle RAT
    - Void Manticore
    - BlankGrabber Stealer
    - VIP Keylogger
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1590.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Windows Office Product Dropped Cab or Inf File
id: dbdd251e-dd45-4ec9-a555-f5e151391746
version: 10
creation_date: '2021-09-10'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector. If confirmed malicious, this could lead to remote code execution, allowing attackers to gain control over the affected system and potentially compromise sensitive data.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
    - Windows Event Log Security 4688 AND Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE `process_office_products`
      BY _time span=1h Processes.action
         Processes.dest Processes.original_file_name Processes.parent_process
         Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
         Processes.parent_process_name Processes.parent_process_path Processes.process
         Processes.process_exec Processes.process_guid Processes.process_hash
         Processes.process_id Processes.process_integrity_level Processes.process_name
         Processes.process_path Processes.user Processes.user_id
         Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | rename process_guid as proc_guid
    | join proc_guid, _time [
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name IN ("*.cab", "*.inf")
      BY _time span=1h Filesystem.dest
         Filesystem.file_create_time Filesystem.file_name Filesystem.file_path
         Filesystem.process_guid
    | `drop_dm_object_name(Filesystem)`
    | rename process_guid as proc_guid
    | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid]
    | dedup file_create_time
    | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
    | `windows_office_product_dropped_cab_or_inf_file_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
references:
    - https://twitter.com/vxunderground/status/1436326057179860992?s=20
    - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
    - https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
finding:
    title: An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Spearphishing Attachments
    - Microsoft MSHTML Remote Code Execution CVE-2021-40444
    - Compromised Windows Host
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
cve:
    - CVE-2021-40444
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Outlook Dialogs Disabled from Unusual Process
id: 94e3ba29-6245-4f25-8d47-d5b6b34c40ac
version: 5
creation_date: '2025-09-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the Windows Registry key "PONT_STRING" under Outlook Options. This disables certain dialog popups, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key changing from an unusual process. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\Options\\General*" Registry.registry_value_name="PONT_STRING" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_name = "Outlook.exe") by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`] | fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_dialogs_disabled_from_unusual_process_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: It is unusual for processes other than Outlook to modify this feature on a Windows system since it is a default Outlook functionality. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
    - https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
finding:
    title: Outlook Dialog registry key modified on $dest$ by unusual process
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NotDoor Malware
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Powershell RemoteSigned File
id: f7f7456b-470d-4a95-9703-698250645ff4
version: 11
creation_date: '2023-06-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of the "remotesigned" execution policy for PowerShell scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing "remotesigned" and "-File". This activity is significant because the "remotesigned" policy allows locally created scripts to run without restrictions, posing a potential security risk. If confirmed malicious, an attacker could execute unauthorized scripts, leading to code execution, privilege escalation, or persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` Processes.process="* remotesigned *" Processes.process="* -File *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_powershell_remotesigned_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible administrators or scripts may run these commands, filtering may be required.
references:
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A PowerShell commandline with remotesigned policy executed on $dest$
        - field: user
          type: user
          score: 20
          message: A PowerShell commandline with remotesigned policy executed on $dest$
analytic_story:
    - Amadey
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint