Splunk rules: 2j

name: AWS Exfiltration via EC2 Snapshot
id: ac90b339-13fc-4f29-a18c-4abbba1f2171
version: 10
creation_date: '2023-03-22'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects a series of AWS API calls related to EC2 snapshots within a short time window, indicating potential exfiltration via EC2 Snapshot modifications. It leverages AWS CloudTrail logs to identify actions such as creating, describing, and modifying snapshot attributes. This activity is significant as it may indicate an attacker attempting to exfiltrate data by sharing EC2 snapshots externally. If confirmed malicious, the attacker could gain access to sensitive information stored in the snapshots, leading to data breaches and potential compliance violations.
data_source:
    - AWS CloudTrail CreateSnapshot
    - AWS CloudTrail DescribeSnapshotAttribute
    - AWS CloudTrail ModifySnapshotAttribute
    - AWS CloudTrail DeleteSnapshot
search: |-
    `cloudtrail` eventName IN ("CreateSnapshot", "DescribeSnapshotAttribute", "ModifySnapshotAttribute", "DeleteSnapshot") src_ip !="guardduty.amazonaws.com"
      | bin _time span=5m
      | rename user_name as user
      | stats count dc(signature) as distinct_api_calls values(signature) as signature values(dest) as dest values(requestParameters.attributeType) as attributeType values(requestParameters.createVolumePermission.add.items{}.userId) as aws_account_id_added values(user_agent) as user_agent
        BY _time user src
           vendor_account vendor_region vendor_product
      | where distinct_api_calls >= 2
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_exfiltration_via_ec2_snapshot_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We have intentionally removed `guardduty.amazonaws.com` from src_ip to remove false positives caused by guard duty. We recommend you adjust the time window as per your environment.
known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with an other account for a specific purpose. Please check any recent change requests filed in your organization.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
    - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
    - https://stratus-red-team.cloud/attack-techniques/list/
finding:
    title: Potential AWS EC2 Exfiltration detected on account id - $vendor_account$ by user $user$ from src_ip $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Instance Activities
    - Data Exfiltration
asset_type: EC2 Snapshot
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: AWS Multiple Failed MFA Requests For User
id: 1fece617-e614-4329-9e61-3ba228c0f353
version: 11
creation_date: '2022-10-03'
modification_date: '2026-05-13'
author: Bhavin Patel
status: production
type: Anomaly
description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests to an AWS Console for a single user. It leverages AWS CloudTrail logs, specifically the `additionalEventData` field, to detect more than 10 failed MFA prompts within 5 minutes. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this could lead to unauthorized access to the AWS environment, potentially compromising sensitive data and resources.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication"
      | bucket span=5m _time
      | rename user_name as user
      | stats dc(_raw) as mfa_prompts min(_time) as firstTime max(_time) as lastTime values(user_agent) as user_agent values(src) as src values(dest) as dest
        BY _time user signature
           vendor_account vendor_region vendor_product
           errorMessage
      | where mfa_prompts > 10
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_multiple_failed_mfa_requests_for_user_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://aws.amazon.com/what-is/mfa/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ is seen to have high number of MFA prompt failures within a short period of time.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD Privileged Role Assigned to Service Principal
id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
version: 14
creation_date: '2023-04-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of privileged roles to service principals in Azure Active Directory (AD). It leverages the AuditLogs log category from ingested Azure AD events. This activity is significant because assigning elevated permissions to non-human entities can lead to unauthorized access or malicious activities. If confirmed malicious, attackers could exploit these service principals to gain elevated access to Azure resources, potentially compromising sensitive data and critical infrastructure. Monitoring this behavior helps prevent privilege escalation and ensures the security of Azure environments.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` operationName="Add member to role"
      | rename properties.* as *
      | search "targetResources{}.type"=ServicePrincipal
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename targetResources{}.modifiedProperties{}.newValue as roles
      | eval role=mvindex(roles,1)
      | rename targetResources{}.displayName as apps
      | eval displayName=mvindex(apps,0)
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product displayName
           initiatedBy result role
           signature
      | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
      | search isprvilegedadrole = True
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_privileged_role_assigned_to_service_principal_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed.
references:
    - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
finding:
    title: A privileged Azure AD role was assigned to the Service Principal $displayName$ initiated by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Privilege Escalation
    - NOBELIUM Group
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Secure Firewall - React Server Components RCE Attempt
id: d36459b1-7901-401a-a67e-44426c15b168
version: 7
creation_date: '2025-07-17'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This analytic detects exploitation activity of CVE-2025-55182 using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 65554 (React Server Components remote code execution attempt) is triggered
    If confirmed malicious, this behavior could be indicative of a potential exploitation of CVE-2025-55182.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id = 65554
    | fillnull
    | stats min(_time) as firstTime
            max(_time) as lastTime
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(src) as src
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            by dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___react_server_components_rce_attempt_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: |
    Security testing or vulnerability scanners might trigger this. Investigate any potential
    matches to determine if they're legitimate.
references:
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
    - https://nextjs.org/blog/CVE-2025-66478
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
    - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3
    - https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
finding:
    title: Potential exploitation of CVE-2025-65554 from $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: system
analytic_story:
    - React2Shell
asset_type: Endpoint
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Detect mshta inline hta execution
id: a0873b32-5b68-11eb-ae93-0242ac130002
version: 22
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of "mshta.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments and process details. This activity is significant because mshta.exe can be exploited to execute malicious scripts, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or establish persistence within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count values(Processes.process)
    as process values(Processes.parent_process) as parent_process min(_time) as firstTime
    max(_time) as lastTime from datamodel=Endpoint.Processes where

    `process_mshta`
    Processes.process IN ("*vbscript*", "*javascript*", "*about*")

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_mshta_inline_hta_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
references:
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
    - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - Gozi Malware
    - Living Off The Land
    - Suspicious MSHTA Activity
    - XWorm
    - APT37 Rustonotto and FadeStealer
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Excessive Usage Of Cacls App
id: 0bdf6092-af17-11eb-939a-acde48001122
version: 13
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
    or `icacls.exe` to change file or folder permissions.
    It looks for 10 or more execution of the aforementioned processes in the span of 1 minute.
    It leverages data from Endpoint Detection and Response (EDR) agents,
    focusing on process names and command-line executions.
    This activity is significant as it may indicate an adversary attempting
    to restrict access to malware components or artifacts on a compromised system.
    If confirmed malicious, this behavior could prevent users from deleting or accessing
    critical files, aiding in the persistence and concealment of malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      min(_time) as firstTime
      max(_time) as lastTime
      values(Processes.dest) as dest
      values(Processes.user) as user
      values(Processes.action) as action
      values(Processes.original_file_name) as original_file_name
      values(Processes.parent_process_exec) as parent_process_exec
      values(Processes.parent_process_guid) as parent_process_guid
      values(Processes.parent_process_id) as parent_process_id
      values(Processes.parent_process_path) as parent_process_path
      values(Processes.process) as process
      values(Processes.process_exec) as process_exec
      values(Processes.process_guid) as process_guid
      values(Processes.process_hash) as process_hash
      values(Processes.process_id) as process_id
      values(Processes.process_integrity_level) as process_integrity_level
      values(Processes.process_name) as process_name
      values(Processes.process_path) as process_path
      values(Processes.user_id) as user_id
      values(Processes.vendor_product) as vendor_product count
    from datamodel=Endpoint.Processes where
    Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
    by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m
    | where count >=10
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_usage_of_cacls_app_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: Administrators or administrative scripts may use this application. Filter as needed.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Azorult
    - Windows Post-Exploitation
    - Prestige Ransomware
    - XMRig
    - Crypto Stealer
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1222
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '17782.29999'
title: File_Folder Hidden - Windows
description: 'This use case detects commands setting the hidden attribute to files
  or folders on Windows systems. This technique is used by threat actors to evade
  detection and conceal malicious files from regular view. Atomics T1222.001 Test
  #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(attrib) OR TERM(attrib.exe))
  "+h" | regex process="(?i)\s\+h\s+" | table _time, host, user parent_*, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md#atomic-test-4---attrib---hide-file

name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
id: 0cb847ee-9423-11ec-b2df-acde48001122
version: 12
creation_date: '2022-02-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when the Kerberos Pre-Authentication flag is disabled in a user account, using Windows Security Event 4738. This event indicates a change in the UserAccountControl property of a domain user object. Disabling this flag allows adversaries to perform offline brute force attacks on the user's password using the AS-REP Roasting technique. This activity is significant as it can be used by attackers with existing privileges to escalate their access or maintain persistence. If confirmed malicious, this could lead to unauthorized access and potential compromise of sensitive information.
data_source:
    - Windows Event Log Security 4738
search: >
    `wineventlog_security` EventCode=4738 UserAccountControl="*%%2096*"
    | rename TargetUserName as user, SubjectUserName as actor | stats count earliest(_time) as firstTime latest(_time) as lastTime by actor, user, dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
    - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
    - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
finding:
    title: Kerberos Pre Authentication was Disabled for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1558.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Non Compliant Devices Accessing M365 Copilot
id: e26bc52d-9cbc-4743-9745-e8781d935042
version: 6
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Anomaly
description: Detects M365 Copilot access from non-compliant or unmanaged devices that violate corporate security policies, indicating potential shadow IT usage, BYOD policy violations, or compromised endpoint access. The detection filters M365 Copilot Graph API events where deviceDetail.isCompliant=false or deviceDetail.isManaged=false, then aggregates by user, operating system, and browser to calculate metrics including event counts, unique IPs and locations, and compliance/management status over time. Users accessing Copilot from non-compliant or unmanaged devices are flagged and sorted by activity volume and geographic spread, enabling security teams to identify unauthorized endpoints that may lack proper security controls, encryption, or MDM enrollment.
data_source:
    - M365 Copilot Graph API
search: |-
    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient") deviceDetail.isCompliant=false OR deviceDetail.isManaged=false
      | eval user = userPrincipalName
      | stats count as events, dc(ipAddress) as unique_ips, values(ipAddress) as ip_addresses, dc(location.city) as unique_cities, values(location.city) as cities, dc(location.countryOrRegion) as unique_countries, values(location.countryOrRegion) as countries, values(deviceDetail.isCompliant) as compliance_status, values(deviceDetail.isManaged) as management_status, min(_time) as first_seen, max(_time) as last_seen
        BY user, deviceDetail.operatingSystem, deviceDetail.browser
      | eval days_active = round((last_seen - first_seen)/86400, 1)
      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
      | sort -events, -unique_countries
      | `m365_copilot_non_compliant_devices_accessing_m365_copilot_filter`
how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
known_false_positives: Legitimate employees using personal devices during emergencies, new hires awaiting device provisioning, temporary workers with unmanaged equipment, or users accessing Copilot from approved but temporarily non-compliant devices may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ accessed M365 Copilot from non-compliant or unmanaged devices accross $unique_countries$ countries, violating corporate security policies and creating potential data exposure risks.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '5996.6372'
title: Modify Windows Defender
description: 'Adversaries may modify security tools to avoid possible detection of
  their tools and activities. This use case looks for abnormalities commonly associated
  with a large number of modifications to windows defender in a short period of time.
  -- Threat Actor Association: BlackByte, Lazarus, Magic Hound (aka APT35, Charming
  Kitten, Phosphorus, and Mint Sandstorm), Memento Team, Muddled Libra, REvil, Vice
  Society - Software Association: Akira, BianLian, Black Basta, Lockbit, Snake, Vice
  Society, XingLocker, Zloader'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(Set-MpPreference)
  OR TERM(Add-MpPreference)) | table _time, host, user process, process_*, singature_id
  | bin span=60s | stats values(*) as * by _time, host | eventstats dc(process) as
  dc_process by process, host, _time | where dc_process > 2 '
techniques:
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1562.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

id: '5982.18112'
title: MSHTA.exe execution
description: 'Detect use of MSHTA. -- Threat Actor Association: Actinium/Gamaredon/Primitive
  Bear, APT37, APT43, FIN7, Kimsuky, MuddyWater, TA551, TA576, UAC-0057 (GhostWriter),
  Wizard Spider -- Software Association: Bazar, Conti, PYSA/Mespinoza, Trickbot, XingLocker,
  Zloader Atomics T1218.005 Test#1 Atomics T1218.005 Test#2 Atomics T1218.005 Test#3
  Atomics T1218.005 Test#4 Atomics T1218.005 Test#5 Atomics T1218.005 Test#6 Atomics
  T1218.005 Test#7 Atomics T1218.005 Test#8 Atomics T1218.005 Test#9 Atomics T1218.005
  Test#10 Atomics T1059.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(mshta.exe) OR TERM(mshta)) | table _time, host, user process, process_*, parent_*,
  signature_id, src_*, dest_* | bin span=1s | stats values(*) as * by _time, host
  | where match(process_name, "(?i)mshta") OR match(process, "(?i)mshta") OR (match(parent_process_name,
  "(?i)mshta") and match(process_name, "(?i)cmd|powershell")) '
techniques:
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1218.005
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- ired.team/offensive-security/code-execution/t1170-mshta-code-execution
- https://attackiq.com/2020/04/20/fingerprinting-fin7/

id: '21579.38122'
title: Potential Executable Masquerading as Document - Windows
description: 'Adversaries may abuse double extensions to attempt to conceal dangerous
  file types of payloads. This use case detects executions of files that appear to
  be document or image files but execute as script or executable files, or executable/script
  files with 3 or more spaces or underscores preceding the extension in an effort
  to obscure the file''s actual extension. CVE-2023-38831 -- Threat Actor Association:
  APT28, APT40, Sandworm Team, UAC-0057 (GhostWriter)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (".pdf" OR ".jpg" OR ".jpeg" OR "gif" OR ".ico" OR ".doc" OR ".xls" OR ".docx" OR
  ".xlsx" OR ".png" OR ".xml" OR ".csv" OR ".ppt" OR ".pptx" OR ".rtf" OR ".txt")
  (".cmd" OR ".bat" OR ".ps1" OR ".vbs" OR ".js" OR ".py" OR ".exe" OR ".msi" OR ".vbe"
  OR ".lnk" OR ".scr") | regex process="(?i)((\s{3,}|_{3,})|(\.(pdf|jpg|jpeg|gif|ico|doc|xls|docx|xlsx|png|xml|csv|ppt|pptx|rtf|txt)(\s+)?))\.(cmd|bat|ps1|vbs|js|py|exe|msi|vbe|lnk|scr)"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:double file extension
technique_id:
- T1036.007
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/

id: '20681.36836'
title: Potential ngrok Tunnel - Windows
description: 'ngrok is a reverse proxy utility with the ability to establish tunnels
  on targets using reverse SSH, even if the target does not have ngrok installed.
  Attackers have been observed abusing ngrok to establish persistence and perform
  lateral movement on compromised targets by exposing RDP services. This use case
  detects artifacts specific to RDP sessions established using ngrok. -- Threat Actor
  Association: Scattered Spider (aka. Muddled Libra, Scatter Swine, Starfraud, UNC3944)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4779) OR
  "<EventID>4779<") "%16777216" | table _time, host, user, process_*, src_ip, src_port,
  dest_ip, dest_port | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
technique_id: 
- T1572
data_category:
- Windows event logs
references:
- https://www.logpoint.com/en/blog/a-deep-look-at-the-darkside-ransomware-operators-and-their-affiliates/
- https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent/

name: PowerShell Start-BitsTransfer
id: 39e2605a-90d8-11eb-899e-acde48001122
version: 12
creation_date: '2021-03-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the PowerShell command `Start-BitsTransfer`, which can be used for file transfers, including potential data exfiltration. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because `Start-BitsTransfer` can be abused by adversaries to upload sensitive files to remote locations, posing a risk of data loss. If confirmed malicious, this could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further exploitation of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` Processes.process=*start-bitstransfer*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_start_bitstransfer_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments.
references:
    - https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
    - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
finding:
    title: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$
analytic_story:
    - BITS Jobs
    - Gozi Malware
asset_type: Endpoint
mitre_attack_id:
    - T1197
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1078.1116'
title: Powersploit SPN Enumeration
description: 'Kerberoast is a series of tools for attacking MS Kerberos implementations.
  Threat Actor Association: APT29/Nobelium/Cozy Bear Software Association: Cuba, Vice
  Society #TrendingThreat #Russia #Ukraine Atomics T1558.003 #Test1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ("Kerberoast.ps1" OR "GetUserSPNS.ps1"
  "KERBEROAST" OR "INVOKE-KERBEROAST" OR "Get-DomainSPNTicket" OR ("Get-NetUser" AND
  "-SPN") OR "Get-SPNTicket" OR "Convert-LDAPProperty" OR ("Get-DomainUser" AND "-SPN"))
  OR ( TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken) OR (TERM(System.DirectoryServices.SearchResult)
  AND TERM(System.Collections.Hashtable))OR(TERM(System.IdentityModel) AND TERM(System.DirectoryServices.ActiveDirectory.Forest)
  AND TERM(GetCurrentForest)) OR (TERM(System.IdentityModel) AND TERM(LoadWithPartialName)
  AND TERM(Reflection.Assembly)) OR (TERM(setspn.exe) AND TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken))
  OR (TERM(System.DirectoryServices.ActiveDirectory.Domain) AND TERM(System.DirectoryServices.ActiveDirectory.DirectoryContext)
  AND (TERM(GetDomain))) OR (TERM(System.DirectoryServices.DirectorySearcher) AND
  TERM(servicePrincipalName) OR TERM(servicePrincipalName)) OR (TERM(System.DirectoryServices.SecurityMasks)
  AND (TERM(Dacl) OR TERM(GROUP) OR TERM(OWNER) OR TERM(SACL) OR TERM(NONE))) OR (TERM(System.DirectoryServices.ReferralChasingOption)
  AND TERM(ALL)) OR (TERM(Security.AccessControl.RawSecurityDescriptor) OR (TERM(System.Security.Principal.SecurityIdentifier)
  AND (TERM(System.MarshalByRefObject)) AND TERM(System.Reflection.BindingFlags) AND
  TERM(GetProperty))) OR TERM(Diagnostics.CodeAnalysis.SuppressMessageAttribute) OR
  (TERM(adminCount=1) ) OR TERM(Management.Automation.PSCredential) OR (TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken)
  AND TERM(System.BitConverter) AND TERM(ToString)) ) | rex field=_raw max_match=5
  (?<known_ioc>"(?i)Kerberoast|GetUserSPNS|Get-DomainSPNTicket|Get-NetUser.+-SPN|Get-SPNTicket|Convert-LDAPProperty|Get-DomainUser.+-SPN")|
  rex field=_raw max_match=1 (?<keywords_spn>"(?i)ServicePrincipalName") | rex field=_raw
  max_match=5 (?<file>"[a-zA-Z0-9_]+.ps1")| rex field=_raw (?<identity>"(?i)System.IdentityModel")
  | rex field=_raw (?<token>"(?i)System.IdentityModel.Tokens.KerberosRequestorSecurityToken")|
  rex field=_raw (?<forest>"(?i)System.DirectoryServices.ActiveDirectory.Forest.+")
  | rex field=_raw (?<setspn>"(?i)setspn.exe") | rex field=_raw (?<ad>"(?i)System.DirectoryServices.ActiveDirectory")
  | rex field=_raw (?<convert>"(?i)System.BitConverter.+ToString") | rex field=_raw
  (?<credential>"(?i)Management.Automation.PSCredential") | rex field=_raw (?<privilege>"(?i)adminCount=1")|
  rex field=_raw (?<error>"(?i)Diagnostics.CodeAnalysis.SuppressMessageAttribute.+")|
  rex field=_raw (?<security1>"(?i)Security.AccessControl.RawSecurityDescriptor")|
  rex field=_raw (?<security2>"(?i)System.Security.Principal.SecurityIdentifier")|
  rex field=_raw (?<properties>"(?i)System.Reflection.BindingFlags.+GetProperty")|
  rename ScriptBlock_ID as scriptblock_id | eval user=mvfilter(NOT match(user, "(?i)convert|_")),
  kerberoast_request=mvappend(keywords_spn, identity, token, forest, setspn, ad, convert,
  credential, privilege, error, security1, security2, properties) | table _time, host,
  user_time, file, host, scriptblock_id, signature_id, event_id, kerberoast_request,
  known_ioc, error | bin span=120s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558.003
data_category:
- PowerShell logs
references:
- https://github.com/nidem/kerberoast
- https://attack.mitre.org/techniques/T1558/003/

name: Prohibited Network Traffic Allowed
id: ce5a0962-849f-4720-a678-753fe6674479
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE All_Traffic.action IN ("allowed", "allow") [
    | inputlookup interesting_ports_lookup where is_prohibited="true"
    | table dest_port transport
    | dedup dest_port transport
    | rename dest_port as All_Traffic.dest_port
    | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule
    | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `prohibited_network_traffic_allowed_filter`
how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potentially Prohibited Network Traffic allowed from $src_ip$
    entity:
        field: src_ip
        type: system
        score: 50
threat_objects:
    - field: dest_ip
      type: ip_address
analytic_story:
    - Prohibited Traffic Allowed or Protocol Mismatch
    - Ransomware
    - Command And Control
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1048
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
baselines:
    - Count of Unique IPs Connecting to Ports

name: Ransomware Notes bulk creation
id: eff7919a-8330-11eb-83f8-acde48001122
version: 16
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame. This activity is significant as it often indicates an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
data_source:
    - Sysmon EventID 11
search: |-
    `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta")
      | bin _time span=10s
      | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path values(action) as action values(file_access_time) as file_access_time values(file_create_time) as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time values(file_path) as file_path values(file_acl) as file_acl values(file_size) as file_size values(process_guid) as process_guid values(process_id) as process_id values(user) as user values(vendor_product) as vendor_product
        BY dest file_name
      | where unique_readme_path_count >= 15
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `ransomware_notes_bulk_creation_filter`
how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A high frequency file creation of $file_name$ in different file path in host $dest$
analytic_story:
    - BlackMatter Ransomware
    - DarkSide Ransomware
    - Chaos Ransomware
    - Rhysida Ransomware
    - LockBit Ransomware
    - Medusa Ransomware
    - Black Basta Ransomware
    - Clop Ransomware
    - Cactus Ransomware
    - Termite Ransomware
    - Interlock Ransomware
    - NailaoLocker Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Schedule Task with HTTP Command Arguments
id: 523c2684-a101-11eb-916b-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation of scheduled tasks on Windows systems that include HTTP command arguments, using Windows Security EventCode 4698. It identifies tasks registered via schtasks.exe or TaskService with HTTP in their command arguments. This behavior is significant as it often indicates malware activity or the use of Living off the Land binaries (lolbins) to download additional payloads. If confirmed malicious, this activity could lead to data exfiltration, malware propagation, or unauthorized access to sensitive information, necessitating immediate investigation and mitigation.
data_source:
    - Windows Event Log Security 4698
search: |-
    `wineventlog_security` EventCode=4698
      | xmlkv Message
      | search Arguments IN ("*http*")
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, Task_Name, Command,
           Author, Enabled, Hidden,
           Arguments
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `schedule_task_with_http_command_arguments_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
known_false_positives: No false positives have been identified at this time.
references:
    - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
finding:
    title: A scheduled task process commandline arguments $Arguments$ with http string in it on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Persistence Techniques
    - Living Off The Land
    - Compromised Windows Host
    - Scheduled Tasks
    - Winter Vivern
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1053
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '33361.59030'
title: Visio.exe File Download
description: Visio.exe is a diagramming and vector graphics application developed
  by Microsoft, used for creating flowcharts, organizational charts, and other visual
  representations of information. Threat actors can abuse visio.exe to download files.
  This use case detects executions of visio.exe followed by URLs in the command line.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell`(TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(visio) | regex
  process="(?i)visio(\.exe(\"|\'')?)?\s+(\"|\'')?[A-Za-z0-9]{2,6}:\/\/[^\s]+" | table
  _time, host, user, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Visio/

id: '12724.31085'
title: Windows - Service Stop
description: 'This use case detects any service stop commands on Windows endpoints.
  Adversaries may stop or disable services on a system to render those services unavailable
  to legitimate users. Stopping critical services or processes can inhibit or stop
  response to an incident or aid in the adversary''s overall objectives to cause damage
  to the environment. Adversaries may accomplish this by disabling individual services
  of high importance to an organization, such as MSExchangeIS, which will make Exchange
  content inaccessible. In some cases, adversaries may stop or disable many or all
  services to render systems unusable. Services or processes may not allow for modification
  of their data stores while running. Adversaries may stop services or processes in
  order to conduct Data Destruction or Data Encrypted for Impact on the data stores
  of services like Exchange and SQL Server. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, Cadet Blizzard, FIN6, GoldenJackal, Kimsuky, Lapsus$, Magic Hound (aka APT35,
  Charming Kitten, Phosphorus, and Mint Sandstorm) , TA2541, Traveling Spider - Software
  Association: AvosLocker, BianLian, BlackByte, Blackcat/ALPHV, Black Basta, Conti,
  Cring, Cuba, GhostShell, Hive, Lockbit, Nefilim, Prestige, Prometheus / Spook, Rhysida,
  Royal, Ryuk, Snatch, TeamTNT, Trigona, WatchDog, WhisperGate, XingLocker -- Atomics
  T1489 Test #1 Atomics T1489 Test #2 Atomics T1489 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(sc.exe) OR
  TERM(sc) OR TERM(net) OR TERM(net.exe)) AND TERM(stop)) OR ( TERM(taskkill) AND
  ( TERM(/IM) OR TERM(/PID) OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc))
  AND TERM(CONFIG) AND TERM(START=) AND TERM(DISABLED)) OR ((TERM(Stop-Process) OR
  TERM(kill) OR TERM(spps)) (TERM(-name) OR TERM(-ProcessName) OR TERM(-id))) OR (TERM(Win32_Process)
  AND ".terminate") | table _time, host, user parent_process*, process, process_*,
  signature_id, user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md#atomic-test-1---windows---stop-service-using-service-controller