Splunk rules: 2l

name: ASL AWS IAM Failure Group Deletion
id: 8d12f268-c567-4557-9813-f8389e235c06
version: 12
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects failed attempts to delete AWS IAM groups, triggered by access denial, conflicts, or non-existent groups. It operates by monitoring CloudTrail logs for specific error codes related to deletion failures. This behavior is significant for a SOC as it may indicate unauthorized attempts to modify access controls or disrupt operations by removing groups. Such actions could be part of a larger attack aiming to escalate privileges or impair security protocols. Identifying these attempts allows for timely investigation and mitigation, preventing potential impact on the organizations security posture.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=DeleteGroup status=Failure http_request.user_agent!=*.amazonaws.com
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_iam_failure_group_deletion_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
references:
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ has had mulitple failures while attempting to delete groups from $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: AWS CreateLoginProfile
id: 2a9b80d3-6340-4345-11ad-212bf444d111
version: 12
creation_date: '2021-03-02'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a login profile for one AWS user by another, followed by a console login from the same source IP. It uses AWS CloudTrail logs to correlate the `CreateLoginProfile` and `ConsoleLogin` events based on the source IP and user identity. This activity is significant as it may indicate privilege escalation, where an attacker creates a new login profile to gain unauthorized access. If confirmed malicious, this could allow the attacker to escalate privileges and maintain persistent access to the AWS environment.
data_source:
    - AWS CloudTrail CreateLoginProfile AND AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName = CreateLoginProfile
      | rename requestParameters.userName as new_login_profile
      | table src_ip eventName new_login_profile userIdentity.userName
      | join new_login_profile src_ip [
      | search `cloudtrail` eventName = ConsoleLogin
      | rename userIdentity.userName  as new_login_profile
      | stats count values(eventName) min(_time) as firstTime max(_time) as lastTime
        BY eventSource aws_account_id errorCode
           user_agent eventID awsRegion
           userIdentity.principalId user_arn new_login_profile
           src_ip dest vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`]
      | rename user_arn as user
      | `aws_createloginprofile_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
references:
    - https://bishopfox.com/blog/privilege-escalation-in-aws
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
finding:
    title: User $user$ is attempting to create a login profile for $new_login_profile$ and did a console login from this IP $src_ip$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: ConnectWise ScreenConnect Path Traversal Windows SACL
id: 4e127857-1fc9-4c95-9d69-ba24c91d52d7
version: 10
creation_date: '2024-02-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. It identifies path traversal attacks by monitoring file system events related to the ScreenConnect service. This activity is significant as it allows unauthorized access to sensitive files and directories, potentially leading to data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access to critical data or execute harmful code, compromising the integrity and security of the affected system. Immediate remediation by updating to version 23.9.8 or above is recommended.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663  ProcessName=*\\ScreenConnect.Service.exe file_path IN ("*\\ScreenConnect\\App_Extensions\\*") file_name IN ("*.aspx","*.ashx") | stats count min(_time) as firstTime max(_time) as lastTime by  ObjectName ObjectType ProcessName AccessMask process_id EventCode Computer Caller_User_Name | rename Computer as dest Caller_User_Name as user ProcessName as process_name |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_windows_sacl_filter`'
how_to_implement: To implement the following query, enable SACL auditing for the ScreenConnect directory(ies). With this data, the following analytic will work correctly. A GIST is provided in the references to assist with enabling SACL Auditing.
known_false_positives: False positives should be limited as the analytic is specific to ScreenConnect path traversal attempts. Tune as needed, or restrict to specific hosts if false positives are encountered.
references:
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
finding:
    title: A path traversal attack against ScreenConnect has been detected on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ConnectWise ScreenConnect Vulnerabilities
    - Compromised Windows Host
    - Seashell Blizzard
asset_type: Endpoint
cve:
    - CVE-2024-1708
    - CVE-2024-1709
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '39292.71008'
title: Control_RunDLL Call from Command Line
description: rundll32.exe can be used to invoke Control_RunDLL, commonly used to execute
  control panel applets (*.cpl) or DLLs via command-line arguments. Threat actors
  can abuse this to run malicious DLLs or load persistence mechanisms by hiding payloads
  behind legitimate-looking control panel functions as observed in attacks associated
  with CVE-2021-40444. This use case detects when Control_RunDLL is called from the
  command line, accounting for instances where rundll32.exe has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(Control_RunDLL)| regex process="(?i)Control_RunDLL" | table _time, host, user
  signature_id, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:system binary proxy execution
- defense-evasion:system binary proxy execution:control panel
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218
- T1218.011
- T1218.002
data_category:
- Windows Sysmon
references:
- https://research.splunk.com/endpoint/c8e7ced0-10c5-11ec-8b03-acde48001122/
- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
- https://attack.mitre.org/techniques/T1218/011/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
- https://redcanary.com/blog/intelligence-insights-december-2021/

name: Disabling NoRun Windows App
id: de81bc46-9213-11eb-adc9-acde48001122
version: 17
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" with a value of "0x00000001". This activity is significant because the Run application is a useful shortcut for executing known applications and scripts. If confirmed malicious, this action could hinder system cleaning efforts and make it more difficult to run essential tools, thereby aiding malware persistence.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
    - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
    - https://blog.malwarebytes.com/detections/pum-optional-norun/
finding:
    title: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6147.6666'
title: Esentutl Execution
description: 'Esentutl is a command-line tool that provides database utilities for
  the Windows Extensible Storage Engine. This use case looks for esentutl execution
  or from an executable running common process command line switches used by adversaries.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
  Wizard Spider Software Association: Bazar, Conti, Trickbot Atomics T1003.002 Test
  #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ( "esentutl.exe" OR (".exe" "/y" "/d") OR "esentutl"
  ) | regex process="(?i)(esentutl|\.exe)\"?\s.*\/y\s.*\/d\s" | table _time, host,
  user, signature_id, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping:ntds
- lateral-movement:lateral tool transfer
- defense-evasion:hide artifacts
technique_id:
- T1105
- T1003.002
- T1003.003
- T1570
- T1564
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

name: Exchange PowerShell Abuse via SSRF
id: 29228ab4-0762-11ec-94aa-acde48001122
version: 11
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
data_source: []
search: |-
    `windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, cs_uri_query, cs_method,
           c_uri
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `exchange_powershell_abuse_via_ssrf_filter`
how_to_implement: The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
known_false_positives: Limited false positives, however, tune as needed.
references:
    - https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF
    - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
    - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
finding:
    title: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ProxyShell
    - BlackByte Ransomware
    - ProxyNotShell
    - Seashell Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '38391.69035'
title: Executable Running as NT AUTHORITY_SYSTEM Registered in BAM
description: Adversaries may exploit software vulnerabilities in an attempt to elevate
  privileges. Exploitation of a software vulnerability occurs when an adversary takes
  advantage of a programming error in a program, service, or within the operating
  system software or kernel itself to execute adversary-controlled code. Security
  constructs such as permission levels will often hinder access to information and
  use of certain techniques, so adversaries will likely need to perform privilege
  escalation to include use of software exploitation to circumvent those restrictions.
  Background Activity Moderator is a Windows service that controls activity of background
  applications. The service was first introduced on Windows 10, specifically, after
  the Fall Creators Update (version 1709). BAM provides the full path of the executable
  files that was run on the system as well as the last execution date and time of
  these files. BAM provides evidence of program execution by listing executables under
  the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>"
  registry key. Each user specific executable is stored under the corresponding SID
  entry. BAM entries are only populated for locally run executables. Launching executables
  on network shares or removable media will not generate BAM entries. Similarly, console
  applications aren't stored on the BAM entry. In addition, BAM entries are removed
  if an executable is removed from its original location; and entries older than 7
  days are removed when Windows boots. This use case detects when an executable running
  as NT AUTHORITY\SYSTEM was registered in BAM registry key. This behavior was observed
  in CVE-2024-30088, but it is not specific only to this issue, rather used only as
  a reference.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=13) OR "<EventID>13<")
  "SYSTEM\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-18" | rex
  field=_raw "<Data Name=\"Details\">(?<details>[^<]+)</Data>"| where match(details,
  "(?i)REG_BINARY\\s\\S+\\.exe$") | table _time, host, user, process, process_*, registry_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:exploitation for privilege escalation
technique_id: 
- T1068
data_category:
- Windows Sysmon
references:
- https://github.com/tykawaii98/CVE-2024-30088/tree/main
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088
- https://attack.mitre.org/techniques/T1068/
- https://dfir.ru/2020/04/08/bam-internals/

name: MCP Filesystem Server Suspicious Extension Write
id: fc2a024a-18c1-4d31-9480-7f04cf3ff293
version: 2
creation_date: '2026-02-17'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Hunting
description: This detection identifies attempts to create executable or script files through MCP filesystem server connections. Threat actors leveraging LLM-based tools may attempt to write malicious executables, scripts, or batch files to disk for persistence or code execution. The detection prioritizes files written to system directories or startup locations which indicate higher likelihood of malicious intent.
data_source:
    - MCP Server
search: |
    `mcp_server` method IN ("write_file", "create_file") direction=inbound
    | spath output=file_path path=params.path
    | spath output=file_content path=params.content
    | eval dest=host
    | eval file_extension=lower(mvindex(split(file_path, "."), -1))
    | where file_extension IN (
        "exe", "dll", "ps1", "bat", "cmd", "vbs", "js", "scr", "msi", "hta", "wsf", "wsh", "pif", "com", "cpl",
        "sh", "bash", "zsh", "ksh", "csh", "tcsh", "fish",
        "py", "pl", "rb", "php", "lua", "awk",
        "so", "dylib", "bin", "elf", "run", "AppImage",
        "deb", "rpm", "pkg", "dmg",
        "plist", "service", "timer", "socket", "conf"
        )
    | eval
        file_path_lower=lower(file_path),
        is_system_path = if(match(file_path_lower, "(windows|system32|syswow64|program files|/usr|/bin|/sbin|/lib|/lib64|/etc|/opt)"), 1, 0),
        is_startup_path = if(match(file_path_lower, "(startup|autorun|cron\.d|crontab|launchd|launchagents|launchdaemons|systemd|init\.d|rc\.d|rc\.local|profile\.d|bashrc|zshrc|bash_profile)"), 1, 0),
        is_hidden_unix = if(match(file_path, "/\.[^/]+$"), 1, 0),
        content_length=len(file_content)
    | stats count min(_time) as firstTime max(_time) as lastTime values(file_path) as file_paths values(file_extension) as extensions max(is_system_path) as targets_system_path max(is_startup_path) as targets_startup_path max(is_hidden_unix) as targets_hidden_file avg(content_length) as avg_content_size by dest, method
    | eval
        targets_system_path=if(isnull(targets_system_path), 0, targets_system_path),
        targets_startup_path=if(isnull(targets_startup_path), 0, targets_startup_path),
        targets_hidden_file=if(isnull(targets_hidden_file), 0, targets_hidden_file)
    | sort - targets_startup_path, - targets_system_path, - targets_hidden_file, - count
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table dest firstTime lastTime count method extensions file_paths targets_system_path targets_startup_path targets_hidden_file avg_content_size
    | `mcp_filesystem_server_suspicious_extension_write_filter`
how_to_implement: Install the MCP Technology Add-on from Splunkbase and ensure MCP filesystem server logging is enabled with proper field extraction for params.path and params.content. Schedule the search to run every 5-15 minutes and tune alerting based on whether system or startup paths are targeted.
known_false_positives: Legitimate developers using LLM assistants to generate scripts or automation tools, DevOps engineers creating deployment scripts, and system administrators generating batch files for maintenance tasks.
references:
    - https://splunkbase.splunk.com/app/8377
    - https://cymulate.com/blog/cve-2025-53109-53110-escaperoute-anthropic/
    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
analytic_story:
    - Suspicious MCP Activities
asset_type: Web Application
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '20543.36412'
title: ntds.dit Command Line
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case specifically looks for command line argument executions with ntds.dit.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: Akira -- Atomics
  T1003.003 Test #2 Atomics T1003.003 Test #3 Atomics T1003.003 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "ntds.dit" | regex
  process="(?i)ntds\.dit" | table _time, host, user process, process_name, signature_id,
  process_msg | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration

id: '20543.36404'
title: ntds.dit Command Line
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case specifically looks for command line argument executions with ntds.dit.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: Akira -- Atomics
  T1003.003 Test #2 Atomics T1003.003 Test #3 Atomics T1003.003 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  "ntds.dit" | regex process="(?i)(ntds\.dit)" | table _time, host, user parent_*,
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration

name: O365 Email Reported By User Found Malicious
id: 7698b945-238e-4bb9-b172-81f5ca1685a1
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. This capability is an enhanced protection feature that can be used within o365 tenants by users to report potentially malicious emails. This correlation looks for any submission that returns a Phish or Malware verdict upon submission.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="Email reported by user as*"
      | fromjson Data
      | rename _raw AS temp etps AS _raw
      | extract pairdelim=";" kvdelim=":"
      | rename _raw AS etps temp AS _raw
      | search RescanVerdict IN (Phish,Malware)
      | rex field=tsd "\<(?<src_user>.+)\>"
      | eval src_user = case(isnull(src_user),tsd,true(),src_user)
      | rename Name as signature, AlertId as signature_id, AlertEntityId as user, tsd as sender, ms as subject
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product signature
           signature_id src_user sender
           subject
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_email_reported_by_user_found_malicious_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You must deploy/allow the usage of the Microsoft Office Report A Message function.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-outlook-report-messages?view=o365-worldwide
finding:
    title: The user $user$ reported an email classified from $src_user$
    entity:
        field: src_user
        type: user
        score: 50
threat_objects:
    - field: subject
      type: email_subject
analytic_story:
    - Spearphishing Attachments
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: O365 Exfiltration via File Sync Download
id: 350837b5-13d3-4c06-b688-db07afbe5050
version: 6
creation_date: '2025-01-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the FileDownloaded event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation IN ("filesyncdownload*") UserAgent="*SkyDriveSync*"
    | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
    | where NOT match(SiteUrl,user_flat)
    | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
    | rename SiteUrl as file_path,Workload as app
    | where count > 50
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_exfiltration_via_file_sync_download_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: It is possible that certain file sync scenarios may trigger this alert, specifically OneNote. Adjust threshold and filtering as needed.
references:
    - https://attack.mitre.org/techniques/T1567/exfil
    - https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
    - https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ synced an excessive number of files [$count$] from $file_path$ using $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Data Exfiltration
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1567
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Okta Multiple Failed Requests to Access Applications
id: 1c21fed1-7000-4a2e-9105-5aaafa437247
version: 6
creation_date: '2023-04-11'
modification_date: '2026-05-13'
author: John Murphy, Okta, Michael Haag, Splunk
status: experimental
type: Hunting
description: The following analytic detects multiple failed attempts to access applications in Okta, potentially indicating the reuse of a stolen web session cookie. It leverages Okta logs to evaluate policy and SSO events, aggregating data by user, session, and IP. The detection triggers when more than half of the app sign-on attempts are unsuccessful across multiple applications. This activity is significant as it may indicate an attempt to bypass authentication mechanisms. If confirmed malicious, it could lead to unauthorized access to sensitive applications and data, posing a significant security risk.
data_source:
    - Okta
search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`"
how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
known_false_positives: False positives may be present based on organization size and configuration of Okta.
references:
    - https://attack.mitre.org/techniques/T1538
    - https://attack.mitre.org/techniques/T1550/004
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1550.004
    - T1538
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '13705.20073'
title: Remote Access Software Execution
description: 'Remote access tools are commonly used as legitimate technical support
  software and may be allowed by application control within a target environment.
  Adversaries may install and use these tools post-compromise as alternate communications
  channels for redundant access or as a way to establish an interactive remote desktop
  session with the target system. They may also be used as a component of malware
  to establish a reverse connection or back-connect to a service or adversary controlled
  system. Installation of many remote access tools may also include persistence (ex:
  the tool''s installation routine creates a Windows Service). This use case detects
  the execution of remote access software known to be used by threat actors. - Threat
  Actor Association: Andariel, APT43, FIN7, Muddled Libra, Scattered Spider (aka.
  0ktapus, UNC3944), Scatter Swine - Software Association: ALPHV/BlackCat, AvosLocker,
  BianLian, Black Basta, Clop, Hive, LockBit, Royal, Trigona - Atomics T1219 Test
  #1 Atomics T1219 Test #2 Atomics T1219 Test #3 Atomics T1219 Test #4 Atomics T1219
  Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("TeamViewer.exe" OR "AnyDesk.exe" OR "LMIIgnition.exe" OR "GoToAssist.exe" OR "ScreenConnect.exe"
  OR "ammyy.exe" OR "RemotePC.exe" OR "NetSupport.exe" OR "UltraViewer_Desktop.exe"
  OR "vncviewer.exe" OR "Splashtop.exe" OR "Supremo.exe" OR "PCICTLUI.exe" OR "QuickAssist.exe") | where
  match(process_name, "(?i)^(TeamViewer\.exe|AnyDesk\.exe|LMIIgnition\.exe|GoToAssist\.exe|ScreenConnect\.exe|ammyy\.exe|RemotePC\.exe|NetSupport\.exe|UltraViewer_Desktop\.exe|vncviewer\.exe|Splashtop\.exe|Supremo\.exe|PCICTLUI\.exe|QuickAssist\.exe)$")|
  table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md

name: Spoolsv Writing a DLL - Sysmon
id: 347fd388-da87-11eb-836d-acde48001122
version: 11
creation_date: '2021-07-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects `spoolsv.exe` writing a `.dll` file, which is unusual behavior and may indicate exploitation of vulnerabilities like CVE-2021-34527 (PrintNightmare). This detection leverages Sysmon EventID 11 to monitor file creation events in the `\spool\drivers\x64\` directory. This activity is significant because `spoolsv.exe` typically does not write DLL files, and such behavior could signify an ongoing attack. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the compromised system.
data_source:
    - Sysmon EventID 11
search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name file_path  process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: Limited false positives. Filter as needed.
references:
    - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
    - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available
    - https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675
    - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
finding:
    title: A process has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - PrintNightmare CVE-2021-34527
    - Black Basta Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1547.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious PlistBuddy Usage via OSquery
id: 20ba6c32-c733-4a32-b64e-2688cf231399
version: 12
creation_date: '2021-02-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects the use of the PlistBuddy utility on macOS to create or modify property list (.plist) files. It leverages OSQuery to monitor process events, specifically looking for commands that interact with LaunchAgents and set properties like RunAtLoad. This activity is significant because PlistBuddy can be used to establish persistence mechanisms, as seen in malware like Silver Sparrow. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, and potentially escalate privileges on the compromised system.
data_source:
    - Osquery Results
search: |-
    `osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*"
      | `suspicious_plistbuddy_usage_via_osquery_filter`
how_to_implement: OSQuery must be installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct.
known_false_positives: Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
references:
    - https://www.marcosantadev.com/manage-plist-files-plistbuddy/
finding:
    title: Suspicious usage of plistbuddy on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Silver Sparrow
asset_type: Endpoint
mitre_attack_id:
    - T1543.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Abused Web Services
id: 01f0aef4-8591-4daa-a53d-0ed49823b681
version: 13
creation_date: '2021-11-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a suspicious process making DNS queries to known, abused web services such as text-paste sites, VoIP, secure tunneling, instant messaging, and digital distribution platforms. This detection leverages Sysmon logs with Event ID 22, focusing on specific query names. This activity is significant as it may indicate an adversary attempting to download malicious files, a common initial access technique. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the target host.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon`
    EventCode=22
    QueryName IN (
        "*//objects.githubusercontent.com*",
        "*anonfiles.com*",
        "*.argotunnel.com*",
        "*cdn.discordapp.com*",
        "*ddns.net*",
        "*dl.dropboxusercontent.com*",
        "*duckdns.org*",
        "*ghostbin.co*",
        "*glitch.me*",
        "*gofile.io*",
        "*hastebin.com*",
        "*mediafire.com*",
        "*mega.nz*",
        "*ngrok.io*",
        "*onrender.com*",
        "*pages.dev*",
        "*paste.ee*",
        "*pastebin.com*",
        "*pastebin.pl*",
        "*pasteio.com*",
        "*pastetext.net*",
        "*privatlab.com*",
        "*privatlab.net*",
        "*send.exploit.in*",
        "*sendspace.com*",
        "*storage.googleapis.com*",
        "*storjshare.io*",
        "*supabase.co*",
        "*temp.sh*",
        "*textbin*",
        "*transfer.sh*",
        "*trycloudflare.com*",
        "*ufile.io*",
        "*w3spaces.com*",
        "*workers.dev*"
    )
    | eval answer=coalesce(answer,"none")
    | eval answer_count=coalesce(answer_count,0)
    | rename dvc as dest
    | stats  min(_time) as firstTime max(_time) as lastTime count
        BY answer answer_count dest process_exec process_guid
           process_name query query_count reply_code_id signature
           signature_id src user_id vendor_product
           QueryName QueryResults QueryStatus
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_abused_web_services_filter`
how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days.
known_false_positives: Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A network connection on known abused web services [$QueryName$] from [$dest$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - NjRAT
    - CISA AA24-241A
    - Malicious Inno Setup Loader
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1102
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Windows AD Replication Request Initiated by User Account
id: 51307514-1236-49f6-8686-d46d93cc2821
version: 15
creation_date: '2022-11-16'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.
data_source:
    - Windows Event Log Security 4662
    - Windows Event Log Security 4624
search: |-
    `wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","domainDNS")
      AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
      AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
    | stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status dest
    | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time
    | appendpipe
        [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"
        | fields - status]
    | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as
        src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
    | `windows_ad_replication_request_initiated_by_user_account_filter`
how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root and all descendant objects. The principals `everybody`,  `Domain Computers`, and  `Domain Controllers` auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes In Filtered Set`
known_false_positives: Azure AD Connect syncing operations and the dcdiag.exe /Test:Replications command.
references:
    - https://adsecurity.org/?p=1729
    - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
    - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
finding:
    title: Windows Active Directory Replication Request Initiated by User Account $user$ from $src_ip$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 50
          message: Windows Active Directory Replication Request Initiated by User Account $user$ from $src_ip$
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1003.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint