Splunk rules: 2k

name: Allow Operation with Consent Admin
id: 7de17d7a-c9d8-11eb-a812-acde48001122
version: 15
creation_date: '2021-06-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects a registry modification that allows the 'Consent Admin' to perform operations requiring elevation without user consent or credentials. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the 'ConsentPromptBehaviorAdmin' value within the Windows Policies System registry path. This activity is significant as it indicates a potential privilege escalation attempt, which could allow an attacker to execute high-privilege tasks without user approval. If confirmed malicious, this could lead to unauthorized administrative access and control over the compromised machine, posing a severe security risk.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name  Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
    - https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
finding:
    title: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
analytic_story:
    - Ransomware
    - Windows Registry Abuse
    - Azorult
    - MoonPeak
asset_type: Endpoint
mitre_attack_id:
    - T1548
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: AWS IAM Assume Role Policy Brute Force
id: f19e09b0-9308-11eb-b7ec-acde48001122
version: 10
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. It leverages AWS CloudTrail logs to identify `MalformedPolicyDocumentException` errors with a status of `failure` and filters out legitimate AWS services. This activity is significant as repeated failures to assume roles can indicate an adversary attempting to guess role names, which is a precursor to unauthorized access. If confirmed malicious, this could lead to unauthorized access to AWS resources, potentially compromising sensitive data and services.
data_source:
    - AWS CloudTrail
search: |-
    `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com)
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name
        BY src, user, vendor_account
           vendor_region, vendor_product, signature,
           dest, errorCode
      | where count >= 2
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_iam_assume_role_policy_brute_force_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
references:
    - https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities/
    - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
    - https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
finding:
    title: User $user$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1580
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Azure AD Multiple Service Principals Created by SP
id: 66cb378f-234d-4fe1-bb4c-e7878ff6b017
version: 13
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects when a single service principal in Azure AD creates more than three unique OAuth applications within a 10-minute span. It leverages Azure AD audit logs, specifically monitoring the 'Add service principal' operation initiated by service principals. This behavior is significant as it may indicate an attacker using a compromised or malicious service principal to rapidly establish multiple service principals, potentially staging an attack. If confirmed malicious, this activity could facilitate network infiltration or expansion, allowing the attacker to gain unauthorized access and persist within the environment.
data_source:
    - Azure Active Directory Add service principal
search: |-
    `azure_monitor_aad` operationName="Add service principal" properties.initiatedBy.app.appId=*
      | rename properties.* as *
      | bucket span=10m _time
      | rename targetResources{}.displayName as displayName
      | rename targetResources{}.type as type
      | rename initiatedBy.app.displayName as src_user
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime dc(displayName) as unique_apps values(displayName) as displayName values(dest) as dest values(src) as src values(user) as user values(user_agent) as user_agent
        BY src_user vendor_account vendor_product
           signature
      | where unique_apps > 3
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multiple_service_principals_created_by_sp_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Certain users or applications may create multiple service principals in a short period of time for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple OAuth applications were created by $src_user$ in a short period of time
analytic_story:
    - Azure Active Directory Persistence
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '6149.6669'
title: BITSadmin Execution
description: 'BITSAdmin is a command line tool used to create and for managing background
  intelligent transfer. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat
  Actor Association: Andariel, APT31, APT41, BlackMatter, Darkside, FIN12, Flax Typhoon
  Software Association: ALPHV/BlackCat, Astaroth, Clop, MINEBRIDGE, Nefilim, Sodinokibi/REvil,
  Ransom Cartel Atomics T1105 Test#9 Atomics T1197 Test#1 Atomics T1197 Test#2 Atomics
  T1197 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("bitsadmin" OR "BITS") | table _time, host, user,
  signature_id, process, process_*, parent_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- persistence:bits jobs
- defense-evasion:bits jobs
- lateral-movement:lateral tool transfer
- command-and-control:ingress tool transfer
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1197
- T1048.003
- T1570
- T1105
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
- https://www.trendmicro.com/en_us/research/18/c/tropic-trooper-new-strategy.html
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

id: '21030.37461'
title: Command Line Spawned by Archive Utility - Windows
description: 'This use case detects command line utility executions with an archive
  utility as a parent process. CVE-2023-38831 -- Threat Actor Association: APT28,
  APT40, Sandworm Team, UAC-0057 (GhostWriter)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("winrar.exe" OR "rar.exe" OR "7z*.exe" OR "peazip.exe" OR "powerarc.exe" OR "bandizip.exe"
  OR "zipware.exe" OR "winzip.exe" OR "powershell.exe" OR "cmd.exe" OR "wscript.exe"
  OR "cscript.exe" OR "regsvr32.exe" OR "rundll32.exe" OR "wmic.exe" OR "control.exe")
  | where match(parent_process_path, "(?i)(winrar|rar|7z.*|peazip|powerarc|bandizip|zipware|winzip*)\.exe")
  and match(process_name, "(?i)(powershell(_ise?)|pwsh|cmd|wscript|cscript|regsvr32|rundll32|wmic|control)\.exe")
  | table _time, host, user parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
- execution:user execution:malicious file
technique_id:
- T1059
- T1204.002
data_category:
- Windows Sysmon
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/

id: '1071.1106'
title: Create_Modify Schtasks
description: 'Detects possible persistent backdoor access using schtasks -- Threat
  Group Association: Actinium/Gamaredon/Primitive Bear, Alloy Taurus/Gallium, APT29/Nobelium/Cozy
  Bear, APT31, APT33, APT34/OilRig, APT35/Phosphorus/Magic Hound, APT41, APT43, BlackByte,
  BlackCat, Blind Eagle/APT-C-36, Evilnum, FIN7, FIN12, Gamaredon Group/Shuckworm,
  GoldenJackal, Lazarus, Memento Team, MuddyWater, Redfly, TA428, Turla (akaSecret
  Blizzard, KRYPTON, and UAC-0003), Vice Society, WinterVivern/UAC-0114, WIRTE, Witchetty
  - Software Association: Blackbyte, Black Basta, BianLian, Cactus, Conti, GoMet,
  HermeticWiper/Trojan.Killdisk, Lockbit, Lorenz, LV, NanoCore, Play, Prestige, Prometheus/Spook,
  Rhysida, Trickbot, XingLocker - Atomics T1036.004 Test #1 Atomics T1053.005 Test#1
  Atomics T1053.005 Test#2 Atomics T1053.005 Test#3 Atomics T1053.005 Test#4 - #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") ("schtasks" AND ("/create" OR "/change")) | table _time, host,
  user session_id, parent_process_name, parent_process_path, process, process_name,
  process_path, process_id, src_user | bin span=60s | stats values(*) as * by _time,
  host, session_id | where len(parent_process_name) > 0 AND match(process, "(?i)/create|/change") '
techniques:
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
technique_id:
- T1053.005
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1053/005/

name: Domain Group Discovery with Adsisearcher
id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7
version: 14
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain groups. It leverages PowerShell Script Block Logging (EventCode=4104) to identify specific script blocks containing `[adsisearcher]` and group-related queries. This activity is significant as it may indicate an attempt by adversaries or Red Teams to enumerate domain groups for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*(objectcategory=group)*" AND ScriptBlockText = "*findAll()*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `domain_group_discovery_with_adsisearcher_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
finding:
    title: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Scattered Lapsus$ Hunters
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1116.1192'
title: Executable Create Script Process
description: 'A BAT file is a DOS batch file used to execute commands with the Windows
  Command Prompt (cmd.exe), this usecase will detect common scripting type like bat,
  sh, and ps1 with an executable parent. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, APT31, APT35/Phosphorus/Magic Hound, APT41, APT43, Blind Eagle/APT-C-36, FIN8,
  Gamaredon Group/Shuckworm, GoldenJackal, Karakurt, Mustang Panda (aka. Stately Taurus//Earth
  Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA413, UAC-0057 (GhostWriter), Vice
  Society, Volt Typhoon, Winter Vivern, Witchetty, Wizard Spider -- Software Association:
  ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta, Blackbyte, Clop,
  Conti, Dharma, Emotet, Hive, LV, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Snatch, Vice Society, TargetCompany, Trigona, XingLocker, Zloader - Atomics T1547.001
  Test#6 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 (TERM("exe") AND
  (TERM(".bat") OR TERM(".ps1") OR TERM(".sh"))) | regex process_name="(?i)\w+\.(exe)"|
  regex process="(?i)\w+\.(bat|ps1|sh)" | table _time, host, user, signature_id, dest_port,
  process, process_name, parent_process_name, parent_process | bin span=1s | stats
  values(*) as * by _time, host, process | eventstats c(process) as c_process | where
  c_process<10 '
techniques:
- execution:command and scripting interpreter
- exfiltration:automated exfiltration
- execution:command and scripting interpreter:windows command shell
- collection:automated collection
technique_id:
- T1059
- T1020
- T1059.003
- T1119
data_category:
- Windows Sysmon
references:
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html

id: '5997.6373'
title: Execution from Startup Folder
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder. This use case looks for executions of processes that reside in those folders.
  NOTE, this use case will not identify the creation or execution of shortcuts(lnks)
  saved in the startup folder. -- Threat Actor Association: APT29/Nobelium, Kimsuky,
  Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta),
  UNC2465 - Software Association: Play, SmokedHAM, YellowCockatoo --'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(Startup) | table _time, host, user process,
  process_*, signature_id, parent_* | bin span=1s | stats values(*) as * by _time,
  host | where match(parent_process_path, "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E")
  OR match(process_path, "(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E") '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html

id: '30490.54568'
title: Kernel Service Installed - Windows
description: Adversaries may bring a signed vulnerable driver onto a compromised machine
  so that they can exploit the vulnerability to execute code in kernel mode. This
  process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries
  may include the vulnerable driver with files delivered during Initial Access or
  download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
  The use case detects Windows System Event ID 7045 with .sys file type.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((EventCode=7045) OR ">7045</EventID>")
  ".sys" | table _time, host, user, signature_id, process_name, ServiceName, ServiceType,
  ImagePath | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- privilege-escalation:exploitation for privilege escalation
technique_id:
- T1543.003
- T1068
data_category:
- Windows event logs
references:
- https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/strategies-to-monitor-and-prevent-vulnerable-driver-attacks/ba-p/4103985
- https://www.loldrivers.io/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1543/003/

name: Linux Csvtool Privilege Escalation
id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'csvtool' command with 'sudo' privileges, which can allow a user to run system commands as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain unauthorized root access. If confirmed malicious, this could lead to full system compromise, allowing an attacker to execute arbitrary commands, escalate privileges, and maintain persistent access.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*csvtool*"
        AND
        Processes.process="*call*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_csvtool_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/csvtool/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Kernel Module Enumeration
id: 6df99886-0e04-4c11-8b88-325747419278
version: 13
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=kmod Processes.process IN ("*lsmod*", "*list*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_kernel_module_enumeration_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://man7.org/linux/man-pages/man8/kmod.8.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumeration kernel modules.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumeration kernel modules.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - XorDDos
    - Linux Rootkit
asset_type: Endpoint
mitre_attack_id:
    - T1082
    - T1014
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Append Cronjob Entry on Existing Cronjob File
id: b5b91200-5f27-11ec-bb4e-acde48001122
version: 10
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects potential tampering with cronjob files on a Linux system by identifying 'echo' commands that append code to existing cronjob files. It leverages logs from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because adversaries often use it for persistence or privilege escalation. If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*echo*"
        AND
        Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", "*/etc/anacrontab*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes. Therefore, it's recommended to adjust filter macros to eliminate such false positives.
references:
    - https://attack.mitre.org/techniques/T1053/003/
    - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
    - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
analytic_story:
    - XorDDos
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Scheduled Tasks
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '33428.59206'
title: Mock System Directory - Windows
description: A Windows User Account Control Bypass technique is capable of achieving
  privilege escalation without displaying a UAC prompt. This method involves creating
  a mock directory with a trailing whitespace and the same name as a legitmate trusted
  location (e.g. "C:\Windows \System32\") and copying required files to it. The mock
  directory can not be created via Windows Explorer, requiring the attacker to create
  it via scripting or command line. This use case detects process or parent process
  file paths (where available depending on log source) for trusted system directories
  (\Windows\system32 or Program Files) including a trailing space before \.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "Windows " OR ("Program " "Files ") OR ("Program
  " "Files" "\(x86\) ") | where match(process_path, "(?i)\s+\x5c") or match(parent_process_path,
  "(?i)\s+\x5c")| table _time, host, user, process, process_*, parent_process, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
- defense-evasion:abuse elevation control mechanism:bypass user account control
- defense-evasion:masquerading
technique_id:
- T1548.002
- T1036
data_category:
- Windows event logs
references:
- https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-bypass-security-disaster-leverage-applocker-and-srp/
- https://www.fortinet.com/blog/threat-research/fickle-stealer-distributed-via-multiple-attack-chain

id: '35366.62196'
title: ngen.exe File Download
description: ngen.exe (Native Image Generator) is a legitimate Windows binary that
  compiles .NET assemblies into native machine code to improve application performance.
  Threat actors can abuse ngen.exe to download files. This use case detects ngen.exe
  executions with commands to download a file from a remote location. Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "ngen.exe" | regex process_name="(?i)ngen\.exe"|
  regex process="(?i)ngen(\.exe(\"|\'')?)?\s+(\"|\'')?[A-Za-z0-9]{2,6}:\/\/[^\s]+"|
  table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ngen/
- https://attack.mitre.org/techniques/T1105/
- https://learn.microsoft.com/en-us/dotnet/framework/tools/ngen-exe-native-image-generator

id: '6172.6717'
title: Nslookup Execution
description: 'nslookup (from name server lookup) is a network administration command-line
  tool for querying the Domain Name System (DNS) to obtain domain name or IP address
  mapping, or other DNS records. Adversaries can use nslookup for various attack methods.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
  FIN7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(nslookup) OR "nslookup.exe") | table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- discovery:system network configuration discovery
technique_id: 
- T1218
- T1016
data_category:
- Windows event logs
references:
- https://isc.sans.edu/forums/diary/Exfiltrating+data+from+very+isolated+environments/23645/
- https://www.securityfocus.com/images/guestfeature/xinetica/How%20attackers%20exploit%20information%20for%20their%20own%20purposes.htm

name: O365 Email Send Attachments Excessive Volume
id: 70a050a2-8537-488a-a628-b60a9558d96a
version: 6
creation_date: '2025-01-23'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_messagetrace` Status=Delivered
    | eval mailtime = _time
    | bin _time span=1hr
    | eval user = lower(SenderAddress), recipient = lower(RecipientAddress)
    | eval InternetMessageId = lower(MessageId)
    | join InternetMessageId, user, _time max=0
      [
      | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf")
      | eval user = lower(UserId), sender = lower(CASE(isnotnull(SendAsUserSmtp),SendAsUserSmtp,isnotnull(SendOnBehalfOfUserSmtp),SendOnBehalfOfUserSmtp,true(),MailboxOwnerUPN)), subject = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),'Item.Subject',Operation IN ("SoftDelete","HardDelete"),'AffectedItems{}.Subject')), -time = _time,file_name = trim(CASE(Operation IN ("Send","SendAs","SendOnBehalf"),split('Item.Attachments',"; "),Operation IN ("SoftDelete","HardDelete"),split('AffectedItems{}.Attachments',"; "))), file_size = CASE(Operation IN ("Send","SendAs","SendOnBehalf"),round(tonumber('Item.SizeInBytes')/1024/1024,2),true(),round(tonumber(replace(file_name, "(.+)\s\((\d+)(b\)$)", "\2"))/1024/1024,2)), InternetMessageId = lower('Item.InternetMessageId')
      | bin _time span=1hr
      | eval file_name = mvfilter(NOT match(file_name, "\.jpg |\.png |\.jpeg |\.gif "))
      | search file_name=*
      | stats values(sender) as sender, values(ClientIPAddress) as src, values(ClientInfoString) as http_user_agent, values(Operation) as signature, values(file_name) as file_name, sum(file_size) as file_size, values(Folder.Path) as file_path, min(-time) as firstTime, max(-time) as lastTime, dc(file_name) as count by _time,user,InternetMessageId
      | where count > 25
      | eval file_name = mvjoin(file_name,"||")
      ]
    | eval file_name = split(file_name,"||")
    | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId
    | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient))
    | search recipient = *
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_email_send_attachments_excessive_volume_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
    - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ sent an excessive number of email attachments [$count$] to external recipient(s) within a short timeframe
threat_objects:
    - field: recipient
      type: email_address
analytic_story:
    - Office 365 Account Takeover
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1070.008
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Excessive SSO logon errors
id: 8158ccc4-6038-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: Anomaly
description: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the `o365_management_activity` dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
      | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
        BY src vendor_account vendor_product
           dest signature user_agent
      | where count >= 5
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_excessive_sso_logon_errors_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
references:
    - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Excessive number of SSO logon errors from $src$ using UserAgent $user_agent$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
    - Cloud Federated Credential Abuse
asset_type: O365 Tenant
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '8154.10006'
title: Potential LSA password filter
description: 'Adversaries may register malicious password filter dynamic link libraries
  (DLLs) into the authentication process to acquire user credentials as they are validated.
  Windows password filters are password policy enforcement mechanisms for both domain
  and local accounts. This use case looks for values added to LSA registry with reg.exe
  - Software Association: Cactus, Vice Society - Atomics T1556.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(add) "control" "lsa" | table _time, host,
  user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify authentication process:password filter dll
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
- persistence:modify authentication process:password filter dll
- credential-access:modify authentication process:password filter dll
technique_id:
- T1556.002
- T1547.002
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf

id: '27238.49663'
title: rundll32.exe Executing DLL from Non-standard Directory
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Because rundll32 is a trusted system utility with the
  ability to execute code, it is a high value target for abuse by threat actors. Threat
  actors leveraging Qbot malware have been observed dropping DLLs into writeable paths
  and calling them with rundll32.exe. This use case detects when a DLL in a nonstandard
  directory is called by rundll32. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "rundll32" ".dll" | regex process!="(?i)(rundll32(\.exe)?\"?\s+(\/\w+\s+)?[\w.]+\.dll)|(C:\x5c(Windows\x5c(System32|WinSxS|SysWoW64)|Program\sFiles(\s\(x86\))?\x5c.+\.dll))"|
  table _time, host, user process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '30808.55043'
title: Suspicious AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  installation of AteraAgent RMM with an IntegratorLogin from non-business email providers.
  In lieu of filtering for specific publicly available mail providers, a negative
  match for expected user email domains can be used.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") "AteraAgent.exe" "/i " "IntegratorLogin=" ("@gmail.com" OR "@hotmail.com"
  OR "@outlook.com" OR "@yandex.ru" OR "@mail.ru" OR "@protonmail.com" OR "@dropmail.me")
  | rex field=process "IntegratorLogin=\"(?<integrator_email>[^\"]+)\""| where match(process,
  "(?i)AteraAgent\.exe.+\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|protonmail)\.com|(yandex|mail)\.ru|dropmail\.me")|
  table _time, host, user, process_*, integrator_email | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/
- https://detection.fyi/the-dfir-report/sigma-rules/windows/process_creation/proc_creation_win_ateraagent_malicious_installations/?query=ateraage