Splunk rules: 2i

name: Cisco SD-WAN Multiple SSH key Authentication from Same Source
id: 23e15133-d825-4e1d-b885-b8fe3909e947
version: 1
creation_date: '2026-06-09'
modification_date: '2026-06-09'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |-
    This hunting analytic identifies multiple distinct SSH publickey fingerprints used to authenticate the same user from the same source IP against a Cisco Catalyst SD-WAN control component.
    After legitimate vManage key rotation or reboot, a new key may appear but the old key should no longer be used; continued use of more than one key from the same source may indicate unauthorized key injection or persistence related to CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk).
    Validate flagged keys and source IPs against known System IPs in SD-WAN Manager and investigate unexpected combinations.
data_source:
    - Cisco SD-WAN Auth Log
search: |-
    `cisco_sd_wan_syslog`
    "Accepted publickey"
    | rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
    | stats dc(ssh_key) as distinct_keys
            values(ssh_key) as ssh_keys
      count by dest user src
    | where distinct_keys > 1
    | `cisco_sd_wan_multiple_ssh_key_authentication_from_same_source_filter`
how_to_implement: |
    This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
    - CVE-2026-20127
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cloud Provisioning Activity From Previously Unseen IP Address
id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
version: 9
creation_date: '2020-11-30'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: Anomaly
description: The following analytic detects cloud provisioning activities originating from previously unseen IP addresses. It leverages cloud infrastructure logs to identify events where resources are created or started, and cross-references these with a baseline of known IP addresses. This activity is significant as it may indicate unauthorized access or potential misuse of cloud resources. If confirmed malicious, an attacker could gain unauthorized control over cloud resources, leading to data breaches, service disruptions, or increased operational costs.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id FROM datamodel=Change
      WHERE (
            All_Changes.action=started
            OR
            All_Changes.action=created
        )
        All_Changes.status=success
      BY All_Changes.src, All_Changes.user, All_Changes.command
    | `drop_dm_object_name("All_Changes")`
    | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data
    | eventstats max(enough_data) as enough_data
    | where enough_data=1
    | eval firstTimeSeenSrc=min(firstTimeSeen)
    | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
    | `security_content_ctime(firstTime)`
    | table firstTime, src, user, object_id, command
    | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
known_false_positives: "This is a strictly behavioral search, so we define \"false positive\" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no \"false positives\" in a traditional sense, there is definitely lots of noise.\nThis search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you."
references: []
intermediate_findings:
    entities:
        - field: object_id
          type: system
          score: 20
          message: User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
        - field: user
          type: user
          score: 20
          message: User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Provisioning Activities
asset_type: AWS Instance
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Cloud Provisioning Activity Sources - Initial
    - Previously Seen Cloud Provisioning Activity Sources - Update

name: Credential Dumping via Copy Command from Shadow Copy
id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the use of the copy command to dump credentials from a shadow copy. It leverages Endpoint Detection and Response (EDR) data to identify processes with command lines referencing critical files like "sam", "security", "system", and "ntds.dit" in system directories. This activity is significant as it indicates an attempt to extract credentials, a common technique for unauthorized access and privilege escalation. If confirmed malicious, this could lead to attackers gaining sensitive login information, escalating privileges, moving laterally within the network, or accessing sensitive data.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
analytic_story:
    - Compromised Windows Host
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disable AMSI Through Registry
id: 9c27ec42-d338-11eb-9044-acde48001122
version: 15
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that disable the Antimalware Scan Interface (AMSI) by setting the "AmsiEnable" value to "0x00000000". This detection leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable". Disabling AMSI is significant as it is a common technique used by ransomware, Remote Access Trojans (RATs), and Advanced Persistent Threats (APTs) to evade detection and impair defenses. If confirmed malicious, this activity could allow attackers to execute payloads with minimal alerts, leading to potential system compromise and data exfiltration.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network operator may disable this feature of windows but not so common.
references:
    - https://blog.f-secure.com/hunting-for-amsi-bypasses/
    - https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
finding:
    title: Disable AMSI Through Registry on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Disabling SystemRestore In Registry
id: f4f837e2-91fb-11eb-8bf6-acde48001122
version: 15
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of registry keys to disable System Restore on a machine. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with System Restore settings. This activity is significant because disabling System Restore can hinder recovery efforts and is a tactic often used by Remote Access Trojans (RATs) to maintain persistence on an infected system. If confirmed malicious, this action could prevent system recovery, allowing the attacker to sustain their foothold and potentially cause further damage or data loss.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: in some cases admin can disable systemrestore on a machine.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
finding:
    title: The Windows registry was modified to disable system restore on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows registry was modified to disable system restore on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - NjRAT
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Excessive DNS Failures
id: 104658f4-afdc-499e-9719-17243f9826f1
version: 11
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: bowesmana, Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. It leverages the Network_Resolution data model, focusing on DNS reply codes that signify errors. This activity is significant because a high number of DNS failures can indicate potential network misconfigurations, DNS poisoning attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Network_Resolution
      WHERE nodename=DNS "DNS.reply_code"!="No Error" "DNS.reply_code"!="NoError" DNS.reply_code!="unknown" NOT "DNS.query"="*.arpa" "DNS.query"="*.*"
      BY "DNS.src" "DNS.query" "DNS.reply_code"
    | `drop_dm_object_name("DNS")`
    | lookup cim_corporate_web_domain_lookup domain as query OUTPUT domain
    | where isnull(domain)
    | lookup update=true alexa_lookup_by_str domain as query OUTPUT rank
    | where isnull(rank)
    | eventstats max(count) as mc
      BY src reply_code
    | eval mode_query=if(count=mc, query, null())
    | stats sum(count) as count values(mode_query) as query values(mc) as max_query_count
      BY src reply_code
    | where count>50
    | `get_asset(src)`
    | `excessive_dns_failures_filter`
how_to_implement: To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model.
known_false_positives: It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.
references: []
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Excessive DNS failures detected on $src$
analytic_story:
    - Suspicious DNS Traffic
    - Command And Control
asset_type: Endpoint
mitre_attack_id:
    - T1071.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Interactive Session on Remote Endpoint with PowerShell
id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
version: 15
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of the `Enter-PSSession` cmdlet to establish an interactive session on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity by searching for specific script block text patterns. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute commands remotely, potentially leading to further compromise of the network and unauthorized access to sensitive information.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `interactive_session_on_remote_endpoint_with_powershell_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
references:
    - https://attack.mitre.org/techniques/T1021/006/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
finding:
    title: An interactive session was opened on a remote endpoint from $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1021.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Docker Shell Execution
id: 03b2b286-fa86-4ec9-b1a1-ec19d314bdf7
version: 4
creation_date: '2026-03-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning
status: production
type: Anomaly
description: |
    This detection identifies shell execution activity associated with Docker containers on Linux systems.
    Specifically, it monitors for interactive or non-interactive shell processes (e.g., `/bin/bash`, `/bin/sh`, `/bin/zsh`) launched via Docker commands such as `docker exec`,  or through container entrypoint overrides.
    Shell execution inside a container may indicate administrative troubleshooting activity.
    However, it can also represent post-exploitation behavior, where an attacker gains access to a container and spawns a shell to execute arbitrary commands, establish persistence, or pivot to the host.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    Processes.process_name=docker*
    Processes.process="* exec *"
    Processes.process IN (
      "* /bin/bash *",
      "* /bin/dash *",
      "* /bin/sh *",
      "* /bin/zsh *",
      "* bash *",
      "* bash",
      "* dash *",
      "* dash",
      "* sh *",
      "* sh",
      "* zsh *",
      "* zsh"
    )
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_docker_shell_execution_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://docs.docker.com/reference/cli/docker/container/exec/
    - https://gtfobins.github.io/gtfobins/docker/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $user$ on endpoint $dest$ spawned a shell in a docker container via the commandline $process$
        - field: user
          type: user
          score: 20
          message: $user$ on endpoint $dest$ spawned a shell in a docker container via the commandline $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1059.013
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1117.1195'
title: MSIExec Install MSI File
description: 'The Windows Installer technology uses Msiexec.exe for installing MSI
  and MSP packages. This tool gives you full control over the installation process.
  -- Threat Actor Association: APT-K-47/Mysterious Elephant, APT36, TA505 -- Software
  Association: Clop, DirtyMoe, Hive, MirrorBlast, Qakbot/Qbot, Yellow Cockatoo/Jupiter
  Infostealer, Zloader -- LOLBAS -- Atomics T1218.007 Test #1 Atomics T1218.007 Test
  #2 Atomics T1218.007 Test #3 Atomics T1218.007 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) TERM(msiexec) ".msi" | regex process="(?i)(msiexec\.exe).*?\.\w{2,5}"| table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/

id: '30578.54662'
title: Parent in Public Folder Suspicious Process
description: Adversaries may attempt to hide artifacts associated with their behaviors
  to evade detection. Adversaries may abuse command and script interpreters to execute
  commands, scripts, or binaries. This use case detects suspicious processes with
  a parent process in the Users\Public directory.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "\\Users\\Public" ("powershell" OR "pwsh" OR "wscript.exe" OR "cscript.exe" OR "bitsadmin"
  OR "certutil" OR "mshta.exe") OR ("cmd.exe" (" /c " OR " /r " OR " /k " )) | regex
  parent_process_path="^C:\x5cUsers\x5cPublic" | table _time, host, user, parent_process_name,
  parent_process_path, process_name, process_path, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
- defense-evasion:hide artifacts
technique_id: 
- T1059
- T1564
data_category:
- Windows Sysmon
references:
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent/
- https://attack.mitre.org/techniques/T1564/
- https://attack.mitre.org/techniques/T1059/

id: '8398.10541'
title: Rare shell script execution
description: 'Unix shell scripts that enable sequential execution of commands as well
  as other typical programming operations such as conditionals and loops. - Threat
  Actor Association: AbcBot, Sandworm (UAC-0165), TeamTNT, Teal Kurma (aka Sea Turtle,
  Marbled Dust, Cosmic Wolf), UNC5221, UTA0178, WatchDog, Winnti Group - Software
  Association: Mélofée'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type=SYSCALL ".sh" | table _time,
  host, user process*, comm | bin span=1s | stats values(*) as * by _time, host |
  eventstats c(comm) as c_comm by comm | where c_comm < 5 and match(comm, "(?i)\.sh") '
techniques:
- execution:command and scripting interpreter:unix shell
technique_id:
- T1059.004
data_category:
- Linux audit logs
references: null

name: Remote Process Instantiation via WinRM and PowerShell Script Block
id: 7d4c618e-4716-11ec-951c-3e22fbd008af
version: 13
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of PowerShell commands that use the `Invoke-Command` cmdlet to start a process on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify such activities. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
references:
    - https://attack.mitre.org/techniques/T1021/006/
    - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
finding:
    title: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1021.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Resize ShadowStorage volume
id: bc760ca6-8336-11eb-bcbb-acde48001122
version: 11
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras
status: production
type: TTP
description: The following analytic identifies the resizing of shadow storage volumes, a technique used by ransomware like CLOP to prevent the recreation of shadow volumes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "vssadmin.exe" with parameters related to resizing shadow storage. This activity is significant as it indicates an attempt to hinder recovery efforts by manipulating shadow copies. If confirmed malicious, this could lead to successful ransomware deployment, making data recovery difficult and increasing the potential for data loss.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name = "cmd.exe"
        OR
        Processes.parent_process_name = "powershell.exe"
        OR
        Processes.parent_process_name = "powershell_ise.exe"
        OR
        Processes.parent_process_name =  "wmic.exe" Processes.process_name = "vssadmin.exe" Processes.process="*resize*" Processes.process="*shadowstorage*" Processes.process="*/maxsize*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `resize_shadowstorage_volume_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network admin can resize the shadowstorage for valid purposes.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
    - https://redcanary.com/blog/blackbyte-ransomware/
    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
finding:
    title: A process $parent_process_name$ attempted to resize shadow copy with commandline $process$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $parent_process_name$ attempted to resize shadow copy with commandline $process$ in host $dest$
analytic_story:
    - Medusa Ransomware
    - Clop Ransomware
    - Compromised Windows Host
    - BlackByte Ransomware
    - VanHelsing Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ServicePrincipalNames Discovery with SetSPN
id: ae8b3efc-2d2e-11ec-8b57-acde48001122
version: 13
creation_date: '2021-10-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of `setspn.exe` to query the domain for Service Principal Names (SPNs). This detection leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line arguments associated with `setspn.exe`. Monitoring this activity is crucial as it often precedes Kerberoasting or Silver Ticket attacks, which can lead to credential theft. If confirmed malicious, an attacker could use the gathered SPNs to escalate privileges or persist within the environment, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_setspn` (Processes.process="*-t*"
        AND
        Processes.process="*-f*")
        OR
        (Processes.process="*-q*"
        AND
        Processes.process="**/**")
        OR
        (Processes.process="*-q*")
        OR
        (Processes.process="*-s*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `serviceprincipalnames_discovery_with_setspn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be caused by Administrators resetting SPNs or querying for SPNs. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
    - https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html
    - https://attack.mitre.org/techniques/T1558/003/
    - https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx
    - https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
    - https://blog.zsec.uk/paving-2-da-wholeset/
    - https://msitpros.com/?p=3113
    - https://adsecurity.org/?p=3466
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principal names.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principal names.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - Active Directory Privilege Escalation
    - Compromised Windows Host
    - Active Directory Kerberos Attacks
asset_type: Endpoint
mitre_attack_id:
    - T1558.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '8651.11135'
title: Suspicious Certificate Authentication
description: 'Adversaries may steal an AD CA’s root certificate, and forge a certificate
  for any active user or computer. This use case looks for Kerberos ticket requests
  with certificate thumbprints. '
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4768) OR
  "<EventID>4768<") Certificate_Issuer_Name=* | eval certificate_name=Certificate_Issuer_Name
  | table _time, host, user process, process_*, parent_process, parent_process_*,
  src_*, dest_*, subject, certificate_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- persistence:modify authentication process
technique_id: 
- T1556
data_category:
- Windows event logs
references:
- https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf

name: Windows Common Abused Cmd Shell Risk Behavior
id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a
version: 10
creation_date: '2023-06-14'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Correlation
description: The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*")
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 4
    | `windows_common_abused_cmd_shell_risk_behavior_filter`
how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased base on internal testing. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance.
known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers.
references:
    - https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html
    - https://www.splunk.com/en_us/blog/security/dark-crystal-rat-agent-deep-dive.html
finding:
    title: Windows Common Abused Cmd Shell Risk Behavior - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Azorult
    - Volt Typhoon
    - Sandworm Tools
    - Windows Post-Exploitation
    - FIN7
    - Qakbot
    - Netsh Abuse
    - DarkCrystal RAT
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Disabling Security Tools
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1222
    - T1049
    - T1033
    - T1529
    - T1016
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Delete or Modify System Firewall
id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f
version: 13
creation_date: '2023-09-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies 'netsh' processes that delete or modify firewall configurations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific keywords. This activity is significant because it can indicate malware, such as NJRAT, attempting to alter firewall settings to evade detection or remove traces. If confirmed malicious, this behavior could allow an attacker to disable security measures, facilitating further compromise and persistence within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_netsh` Processes.process = "* firewall *" Processes.process = "* del*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_delete_or_modify_system_firewall_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator may modify or delete firewall configuration.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
analytic_story:
    - NjRAT
    - ShrinkLocker
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Change Password Through Registry
id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
version: 14
creation_date: '2022-03-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects a suspicious registry modification that disables the Change Password feature on a Windows host. It identifies changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" with a value of "0x00000001". This activity is significant as it can prevent users from changing their passwords, a tactic often used by ransomware to maintain control over compromised systems. If confirmed malicious, this could hinder user response to an attack, allowing the attacker to persist and potentially escalate their access within the network.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
references:
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Registry modification in "DisableChangePassword" on $dest$
analytic_story:
    - Ransomware
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Driver Inventory
id: f87aa96b-369b-4a3e-9021-1bbacbfcb8fb
version: 8
creation_date: '2023-02-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies drivers being loaded across the fleet. It leverages a PowerShell script input deployed to critical systems to capture driver data. This detection is significant as it helps monitor for unauthorized or malicious drivers that could compromise system integrity. If confirmed malicious, such drivers could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source: []
search: |-
    `driverinventory`
      | stats values(Path) min(_time) as firstTime max(_time) as lastTime count
        BY host DriverType
      | rename host as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_driver_inventory_filter`
how_to_implement: To capture the drivers by host, utilize the referenced Gist to create the inputs, props and transforms. Otherwise, this hunt query will not work.
known_false_positives: Filter and modify the analytic as you'd like. Filter based on path. Remove the system32\drivers and look for non-standard paths.
references:
    - https://gist.github.com/MHaggis/3e4dc85c69b3f7a4595a06c8a692f244
analytic_story:
    - Windows Drivers
asset_type: Endpoint
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Excessive Usage Of Net App
id: 355ba810-0a20-4215-8485-9ce3f87f2e38
version: 9
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects excessive usage of `net.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_net`
      BY Processes.process_name Processes.parent_process_name Processes.original_file_name
         Processes.dest Processes.user _time
         span=1m
    | where count >=10
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_excessive_usage_of_net_app_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$
        - field: dest
          type: system
          score: 20
          message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Prestige Ransomware
    - Graceful Wipe Out Attack
    - XMRig
    - Windows Post-Exploitation
    - Azorult
    - Ransomware
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1531
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows File and Directory Permissions Remove Inheritance
id: 9b62da2c-e442-474f-83ca-fac4dabab1b3
version: 7
creation_date: '2023-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the removal of permission inheritance using ICACLS. This analytic identifies instances where ICACLS is used to remove permission inheritance from files or directories. The /inheritance:r flag, which strips inherited permissions while optionally preserving or altering explicit permissions, is monitored to detect changes that may restrict access or establish isolated permission configurations. Removing inheritance can be a legitimate administrative action but may also indicate an attempt to conceal malicious activity or bypass inherited security controls.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
        AND
        Processes.process = "*/inheritance:r*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_file_and_directory_permissions_remove_inheritance_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
references:
    - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$process_name$] was executed on [$dest$] attempting to remove inheritance permissions.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint