Splunk rules: 2m

name: Cisco Smart Install Port Discovery and Status
id: ded9f9d7-edb8-48cf-8b72-1b459eee6785
version: 6
creation_date: '2025-08-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. Smart Install is a plug-and-play configuration and image-management feature that helps customers to deploy Cisco switches. This protocol has been exploited via CVE-2018-0171, a vulnerability that allows unauthenticated remote attackers to execute arbitrary code or cause denial of service conditions. Recently, Cisco Talos reported that a Russian state-sponsored threat actor called "Static Tundra" has been actively exploiting this vulnerability to compromise unpatched and end-of-life network devices. Monitoring for traffic to this port can help identify potential exploitation attempts or unauthorized Smart Install activity.
data_source:
    - Splunk Stream TCP
search: |-
    | tstats `security_content_summariesonly` count values(All_Traffic.src_ip) as src_ip values(All_Traffic.src_port) as src_port values(All_Traffic.dest_ip) as dest_ip earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE All_Traffic.dest_port=4786
        AND
        All_Traffic.transport=tcp
      BY All_Traffic.dest_ip All_Traffic.dest_port
    | `drop_dm_object_name("All_Traffic")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_smart_install_port_discovery_and_status_filter`
how_to_implement: To implement this search, you need to be ingesting network traffic data into the Network_Traffic data model. This can be accomplished using Splunk Stream, which captures and indexes network traffic. Specifically, you need to ensure that TCP traffic is being monitored and indexed with the sourcetype "stream:tcp". The search looks for traffic destined to port 4786, which is used by the Cisco Smart Install protocol. For optimal security, organizations should consider blocking this port at their network perimeter to prevent external exploitation attempts. However, monitoring for both external and internal traffic to this port is valuable for detecting potential malicious activity. You may need to modify this search to focus on traffic patterns specific to your environment, such as monitoring only for inbound traffic from external sources or for unexpected internal communications using this protocol.
known_false_positives: Legitimate use of Cisco Smart Install may generate traffic to port 4786 within environments that actively use this feature for switch deployment and management. Network administrators might use Smart Install for legitimate device configuration purposes, especially during network deployment or maintenance windows. To reduce false positives, baseline normal Smart Install usage patterns in your environment and consider implementing time-based filtering to alert only on unexpected usage outside of scheduled maintenance periods. Additionally, consider whitelisting known management stations that legitimately use Smart Install.
references:
    - https://blog.talosintelligence.com/static-tundra/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
    - https://github.com/AlrikRr/Cisco-Smart-Exploit
    - https://www.exploit-db.com/exploits/44451
finding:
    title: Detected network traffic to Cisco Smart Install port (4786) on $dest_ip$. Possible access to Cisco Smart Install.
    entity:
        field: dest_ip
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Scattered Lapsus$ Hunters
    - Cisco Smart Install Remote Code Execution CVE-2018-0171
asset_type: Network
cve:
    - CVE-2018-0171
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '15032.22220'
title: Command Line .cmd Execution
description: 'Adversaries may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and/or security tools. Masquerading
  occurs when the name or location of an object, legitimate or malicious, is manipulated
  or abused for the sake of evading defenses and observation. This may include manipulating
  file metadata, tricking users into misidentifying the file type, and giving legitimate
  task or service names. This use case detects the use of cmd.exe /c to execute .cmd
  files. This technique has been used by BazaLoader to execute malware masquerading
  as a PDF inside a .zip file. -- Threat Actor Association: Andariel, APT28, APT40,
  APT-K-47/Mysterious Elephant, GoldenJackal, Kimsuky, Rhysida, Sandworm Team, Volt
  Typhoon -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "cmd.exe" "/c" ".cmd" | regex process="(?i)cmd.*\s+/c\s+.*?\w+\.cmd"
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960

name: Detect Regsvcs Spawning a Process
id: bc477b57-5c21-4ab6-9c33-668772e7f114
version: 15
creation_date: '2021-02-12'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies regsvcs.exe spawning a child process. This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is regsvcs.exe. This activity is significant because regsvcs.exe rarely spawns child processes, and such behavior can indicate an attempt to bypass application control mechanisms. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. Immediate investigation is recommended to determine the legitimacy of the spawned process and any associated suspicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=regsvcs.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regsvcs_spawning_a_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Regsvcs Regasm Activity
    - Living Off The Land
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1218.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: F5 TMUI Authentication Bypass
id: 88bf127c-613e-4579-99e4-c4d4b02f3840
version: 9
creation_date: '2023-10-30'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the CVE-2023-46747 vulnerability, an authentication bypass flaw in F5 BIG-IP's Configuration utility (TMUI). It identifies this activity by monitoring for specific URI paths such as "*/mgmt/tm/auth/user/*" with the PATCH method and a 200 status code. This behavior is significant for a SOC as it indicates potential unauthorized access attempts, leading to remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, steal data, disrupt systems, or conduct further malicious activities within the network.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/mgmt/tm/auth/user/*") Web.http_method=PATCH Web.status=200
      BY Web.http_user_agent, Web.status Web.http_method,
         Web.url, Web.url_length, Web.src,
         Web.dest, sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `f5_tmui_authentication_bypass_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relevant for traffic into the `Web` datamodel.
known_false_positives: False positives should be limited to as this is strict to active exploitation. Reduce noise by filtering to F5 devices with TMUI enabled or filter data as needed.
references:
    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
    - https://github.com/projectdiscovery/nuclei-templates/blob/3b0bb71bd627c6c3139e1d06c866f8402aa228ae/http/cves/2023/CVE-2023-46747.yaml
finding:
    title: Potential CVE-2023-46747 F5 TMUI Authentication Bypass may be occurring against $dest$ from $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - F5 Authentication Bypass with TMUI
asset_type: Network
cve:
    - CVE-2023-46747
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: endpoint

name: First Time Seen Child Process of Zoom
id: e91bd102-d630-4e76-ab73-7e3ba22c5961
version: 11
creation_date: '2020-05-28'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies the first-time execution of child processes spawned by Zoom (zoom.exe or zoom.us). It leverages Endpoint Detection and Response (EDR) data, specifically monitoring process creation events and comparing them against previously seen child processes. This activity is significant because the execution of unfamiliar child processes by Zoom could indicate malicious exploitation or misuse of the application. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the endpoint.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime values(Processes.user) as user values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.parent_process_name=zoom.exe
            OR
            Processes.parent_process_name=zoom.us
        )
      BY Processes.process_id Processes.dest
    | `drop_dm_object_name(Processes)`
    | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen
    | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`")
    | `security_content_ctime(firstTime)`
    | `first_time_seen_child_process_of_zoom_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
        - field: dest
          type: system
          score: 20
          message: Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Zoom Child Processes
asset_type: Endpoint
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
baselines:
    - Previously Seen Zoom Child Processes - Update
    - Previously Seen Zoom Child Processes - Initial

id: '32248.57379'
title: Group Policy Editor Execution
description: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
  Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and
  is used in several ways in either its GUI or in a command prompt. MMC can be used
  to create, open, and save custom consoles that contain administrative tools created
  by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems
  locally or remotely. MMC can also be used to open Microsoft created .msc files to
  manage system configuration. For example, mmc gpedit.msc, will open the Group Policy
  Editor application window. This use case detects gpedit.msc executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(EventCode=4103)
  OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<")) (TERM(gpedit)
  OR "gpedit.msc") | table _time, host, user, process, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1218/014/
- https://www.itechtics.com/enable-gpedit-windows-10-home/

name: Gsuite Drive Share In External Email
id: f6ee02d6-fea0-11eb-b2c2-acde48001122
version: 12
creation_date: '2021-08-16'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: experimental
type: Anomaly
description: The following analytic detects Google Drive or Google Docs files shared externally from an internal domain. It leverages GSuite Drive logs, extracting and comparing the source and destination email domains to identify external sharing. This activity is significant as it may indicate potential data exfiltration by an attacker or insider. If confirmed malicious, this could lead to unauthorized access to sensitive information, data leakage, and potential compliance violations. Monitoring this behavior helps in early detection and mitigation of data breaches.
data_source:
    - G Suite Drive
search: |
    `gsuite_drive` NOT (email IN("", "null"))
    | spath path=parameters.owner output=owner
    | rex field=owner "[^@]+@(?<src_domain>[^@]+)"
    | rex field=email "[^@]+@(?<dest_domain>[^@]+)"
    | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com"
    | eval phase="plan"
    | eval severity="low"
    | stats values(parameters.doc_title) as doc_title,
      values(parameters.doc_type) as doc_types,
      values(email) as dst_email_list,
      values(parameters.visibility) as visibility,
      values(parameters.doc_id) as doc_id,
      count min(_time) as firstTime max(_time) as lastTime
      by parameters.owner ip_address phase severity
    | rename parameters.owner as user ip_address as src_ip
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `gsuite_drive_share_in_external_email_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
known_false_positives: network admin or normal user may share files to customer and external team.
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
intermediate_findings:
    entities:
        - field: dst_email_list
          type: user
          score: 20
          message: Suspicious share gdrive from $user$ to $dst_email_list$ namely as $doc_title$
        - field: user
          type: user
          score: 20
          message: Suspicious share gdrive from $user$ to $dst_email_list$ namely as $doc_title$
analytic_story:
    - Scattered Lapsus$ Hunters
    - Dev Sec Ops
    - Insider Threat
asset_type: GSuite
mitre_attack_id:
    - T1567.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Gsuite Outbound Email With Attachment To External Domain
id: dc4dc3a8-ff54-11eb-8bf7-acde48001122
version: 9
creation_date: '2021-08-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Stanislav Miskovic, Splunk
status: production
type: Hunting
description: The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. It leverages Gsuite Gmail logs, parsing the source and destination email domains, and flags emails with fewer than 20 outbound instances. This activity is significant as it may indicate potential data exfiltration or insider threats. If confirmed malicious, an attacker could use this method to exfiltrate sensitive information, leading to data breaches and compliance violations.
data_source:
    - G Suite Gmail
search: |-
    `gsuite_gmail` num_message_attachments > 0
      | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
      | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
      | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="low"
      | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime
        BY dest_domain phase severity
      | where numSrcAddresses < 20
      | sort - numSrcAddresses
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_outbound_email_with_attachment_to_external_domain_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
analytic_story:
    - Dev Sec Ops
    - Insider Threat
asset_type: GSuite
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

id: '29278.52822'
title: HTTP_HTTPS Default Security Zone Modified to Local Machine
description: Threat actors may Windows Registry to reconfigure the default Internet
  Zone settings for both HTTP and HTTPS, aligning them with the "My Computer" zone.
  The effectively grants websites the same level of trust as files and applications
  locally stored on your machine. This use case detects modifications to Windows registry
  settings to elevate trust levels for websites, treating them similarly to locally
  stored files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet
  Settings\\ZoneMap\\ProtocolDefaults" (" http " OR " https ") (" /d " OR "-Value"
  OR "0x00000000") | regex process="(?i)HKCU|HKEY_CURRENT_USER|HKLM|HKEY_LOCAL_MACHINE|HKU"
  | regex process="(?i)\/d\s+0|\-Value\s+0|0x00000000" | table _time, host, user,
  process, process_name, parent_process_name | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:modify registry
technique_id: 
- T1112
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://twitter.com/JAMESWT_MHT/status/1699042827261391247
- https://attack.mitre.org/techniques/T1112/

name: Kubernetes Pod Created in Default Namespace
id: 3d6b1a81-367b-42d5-a925-6ef90b6b9f1e
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of Kubernetes pods in the default, kube-system, or kube-public namespaces. It leverages Kubernetes audit logs to identify pod creation events within these specific namespaces. This activity is significant for a SOC as it may indicate an attacker attempting to hide their presence or evade defenses. Unauthorized pod creation in these namespaces can suggest a successful cluster breach, potentially leading to privilege escalation, persistent access, or further malicious activities within the cluster.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=pods verb=create objectRef.namespace IN ("default", "kube-system", "kube-public")
      | fillnull
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_pod_created_in_default_namespace_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes Pod Created in Default Namespace by $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '24144.44554'
title: MSIExec.exe Execution
description: msiexec.exe is a Windows system component used to install and modify
  software packages using Windows Installer. Threat actors may abuse msiexec.exe to
  install malicious software or execute scripts, leveraging its legitimate appearance
  to bypass security measures and gain persistence on a targeted system as observed
  in FlawedGrace attacks. This use case detects any execution of msiexec.exe. Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(msiexec) OR "msiexec.exe" | regex process_name="(?i)msiexec\.exe" | table _time,
  host, user process, process_*, parent_process_name, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

id: '27585.50194'
title: NirCmd Execution
description: 'NirCmd is a command line utility with capabilities to delete files from
  Recycling Bin, delete registry keys, take screenshots and execute command without
  displaying a user interface. While it has legitimate administrative uses, threat
  actors including Mint Sandstorm aka PHOSPHORUS have been observed using renamed
  NirCmd to execute malicious code. This use case detects executions of NirCmd.exe
  or command line argument patterns consistent with abusive activities observed with
  NirCmd, accounting for instances where it has been renamed. Allowlisting is recommended
  for executables using the same command line arguments for best results. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "NirCmd" OR ((" execmd " OR ".exe script " OR
  ".exe shexec " OR " runinteractive " OR " runinteractivecmd " OR " savescreenshot
  " OR " savescreenshotfull " OR "savescreenshotwin " OR " regdelval " OR " regdelkey
  " OR " regsetval ") OR ((" exec " OR " exec2 ") (" show " OR " hide "))) | where
  match(process_name, "(?i)nircmd\.exe") or match(process, "(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)|regsetval|exec2?\s+(show|hide))\s|\.exe\s+(script|shexec)")
  | table _time, host, user, process, parent_process_name, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:screen capture
- execution:command and scripting interpreter
- defense-evasion:indicator removal
technique_id: 
- T1113
- T1059
- T1070
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
- https://asec.ahnlab.com/ko/45153/
- https://nircmd.nirsoft.net/
- https://www.nirsoft.net/utils/nircmd.html

name: Overwriting Accessibility Binaries
id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects modifications to Windows accessibility binaries such as sethc.exe, utilman.exe, osk.exe, Magnify.exe, Narrator.exe, DisplaySwitch.exe, and AtBroker.exe. It leverages filesystem activity data from the Endpoint.Filesystem data model to identify changes to these specific files. This activity is significant because adversaries can exploit these binaries to gain unauthorized access or execute commands without logging in. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and further compromise of the environment.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`'
how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.
references: []
finding:
    title: A suspicious file modification or replace in $file_path$  in host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Data Destruction
    - Hermetic Wiper
    - Windows Privilege Escalation
    - Flax Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1546.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Permission Modification using Takeown App
id: fa7ca5c6-c9d8-11eb-bce9-acde48001122
version: 12
creation_date: '2021-06-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the modification of file or directory permissions using the takeown.exe Windows application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process GUID, process name, and command-line details. This activity is significant because it is a common technique used by ransomware to take ownership of files or folders for encryption or deletion. If confirmed malicious, this could lead to unauthorized access, data encryption, or data destruction, severely impacting the integrity and availability of critical data.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "takeown.exe" Processes.process = "*/f*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `permission_modification_using_takeown_app_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: takeown.exe is a normal windows application that may used by network operator.
references:
    - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Sandworm Tools
    - Ransomware
    - Crypto Stealer
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1222
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27535.50073'
title: Potential PowerShell Post-Exploitation Activity
description: 'Threat actors may perform post-exploitation activities using PowerShell
  scripts such as ADRecon. When running ADRecon, PowerShell launches child processes
  to compile and execute payloads and creates several .cmdline files in AppData\Local\Temp
  directories. This use case detects PowerShell-invoked compilations involving csc.exe
  and cvtres.exe referencing multiple .cmdline files from temp directories within
  a 5 minute time period. This may that a malicious script like ADRecon has been executed,
  regardless of the script title name or cmdlets invoked. Atomics T1087.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("powershell.exe" OR "pwsh.exe") ("csc.exe" OR
  "cvtres.exe") ".cmdline" | regex parent_process_name="(?i)(powershell|pwsh)\.exe"|
  regex process_name="(?i)(csc|cvtres)\.exe"| regex process="(?i)\x5cAppData\x5cLocal\x5cTemp.+\.cmdline"
  | table _time, host, user process, parent_process_name, event_count | bin span=300s
  | stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
  host, _time| where dc_process > 3 '
techniques:
- execution:command and scripting interpreter:powershell
- discovery:account discovery
- discovery:system information discovery
technique_id:
- T1059.001
- T1087
- T1082
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/sense-of-security/ADRecon/tree/master
- https://www.dnif.it/en/blog/strategies-to-detect-post-exploitation-active-directory-reconnaissance
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker

name: Powershell Processing Stream Of Data
id: 0d718b52-c9f1-11eb-bc61-acde48001122
version: 19
creation_date: '2021-06-14'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104.
    It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods.
    This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection.
    If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN (
        "*IO.Compression.*",
        "*IO.StreamReader*",
        "*]::Decompress*"
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id
         user_id vendor_product EventID
         Guid Opcode Name
         Path ProcessID ScriptBlockId
         ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_processing_stream_of_data_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: powershell may used this function to process compressed data.
references:
    - https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing stream commands to process compressed or decompressed binary file was executed on host $dest$
analytic_story:
    - Hellcat Ransomware
    - Malicious PowerShell
    - Medusa Ransomware
    - PXA Stealer
    - Data Destruction
    - Braodo Stealer
    - AsyncRAT
    - Hermetic Wiper
    - IcedID
    - XWorm
    - MoonPeak
    - MuddyWater
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '21901.38719'
title: ProtocolHandler.exe File Download
description: ProtocolHandler.exe is a component of Microsoft Office and is typically
  used for accessing Microsoft Office documents from Outlook and Sharepoint. Adversaries
  can use ProtocolHandler.exe to download files. This use case detects executions
  of ProtocolHandler.exe followed by URLs in the command line. Allowlisting of expected
  Sharepoint domains is recommended to reduce false positives. LOLBINS/LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "ProtocolHandler.exe" | regex process="(?i)ProtocolHandler\.exe\"?\s+\"?[A-Za-z0-9]{2,6}:\/\/"
  | table _time, host, user, signature_id, process, process_*, parent_process_path,
  parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/

id: '22624.40845'
title: Remote Share Directory Listing - Windows
description: 'Threat actors may seek to enumerate local administrative access on remote
  systems during reconnaissance activities. This use case detects commands to list
  files and directories on administrative shares (C$, Admin$, or IPC$). Note: dir
  and tree commands do not generate process creation logs and will only be detected
  if called with another executable, e.g. "cmd.exe /c dir".'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(dir) OR TERM(ls) OR TERM(Get-ChildItem) OR TERM(gci) OR TERM(tree)) ("C$"
  OR "ADMIN$" OR "IPC$") | regex process="(?i)\x5c\x5c(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\x5c(C|ADMIN|IPC)\$"
  | table _time, host, user user, process, process_*, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/

id: '1041.1224'
title: Suspicious Executable by Powershell
description: 'Detect when an executable has been launched by powershell and similar
  processes. Such as powershell cscript or cmd and similar processes spawning cmd.exe,
  cscript rundll32 and similar processes being a child process of powershell. - Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT34/OilRig, APT41, APT43, FIN7, Flax
  Typhoon, Lancefly, MuddyWater, RedEyes - Software Association: Bazarloader, Blackbyte,
  IcedID, Qakbot/Qbot - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "powershell.exe" ("cmd.exe" OR "services.exe"
  OR "dllhost.exe" OR "rundll32.exe" OR "cscript.exe" OR "mshta.exe" OR "regsvr32.exe")
  | regex parent_process_name="(?i)(powershell\.exe)" | regex process_path="(?i)((cmd)|(services)|(dllhost)|(rundll32)|(mshta)|(regsvr32)|(cscript))\.exe"
  | table _time, host, user event_id, parent_*, process_*, process, signature_id,
  src_*, dest_* | bin span=1s | stats values(*) as * by _time, host | where isnotnull(user) '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- Windows event logs
references:
- https://docs.broadcom.com/doc/increased-use-of-powershell-in-attacks-16-en
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf

name: Windows Default Rdp File Unhidden
id: f5c1f64b-db59-4913-991e-3dac8adff288
version: 6
creation_date: '2021-06-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies the use of attrib.exe to remove hidden (-h) or system (-s) attributes from the Default.rdp file, which is automatically created in a user's Documents folder when a Remote Desktop Protocol (RDP) session is initiated using mstsc.exe. The Default.rdp file stores session configuration details such as the remote host address and screen settings. Unhiding this file is uncommon in normal user behavior and may indicate that an attacker or red team operator is attempting to access or manipulate RDP connection history that was previously hidden—either by default or as part of an earlier anti-forensics effort. This activity may represent part of a broader pattern of reconnaissance or staging for credential reuse, lateral movement, or forensic analysis evasion. Monitoring for this behavior can help uncover suspicious manipulation of user artifacts and highlight interactive attacker activity on a compromised host.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "attrib.exe" Processes.process IN("*-s*", "*-h*") Processes.process = "*default.rdp*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_default_rdp_file_unhidden_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
    - https://thelocalh0st.github.io/posts/rdp/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process unhiding default.rdp on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Created with Suspicious Service Name
id: 35eb6d19-a497-400c-93c5-645562804b11
version: 9
creation_date: '2025-02-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects the creation of a Windows Service with a known suspicious or malicious name using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify these services installations. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system` EventCode=7045
    | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID
    | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "")
    | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id
    | lookup windows_suspicious_services service_name as object_name
    | where isnotnull(tool_name)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_service_created_with_suspicious_service_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
known_false_positives: Legitimate applications may install services with uncommon services paths.
references:
    - https://attack.mitre.org/techniques/T1569/002/
    - https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16
    - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
    - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_windows_services_names_list.csv
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A known malicious service name $object_name$ was created using $process$ on $dest$, this may indicate the presence of [$tool_name$]
threat_objects:
    - field: object_name
      type: signature
    - field: process
      type: process
analytic_story:
    - Active Directory Lateral Movement
    - Brute Ratel C4
    - CISA AA23-347A
    - Clop Ransomware
    - Flax Typhoon
    - PlugX
    - Qakbot
    - Snake Malware
    - Tuoni
    - Gh0st RAT
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint