Splunk rules: 2n

id: '19280.34213'
title: Account Password Changed from Command Line - Windows
description: 'Adversaries may interrupt availability of system and network resources
  by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted,
  locked, or manipulated (ex: changed credentials) to remove access to accounts. This
  use case detects commands involving the use of net.exe to change account passwords.
  Atomics T1531 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") (TERM(net) OR TERM(net1) OR "net.exe" OR "net1.exe") TERM(user)
  | regex process="(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+"| regex process!="(?i)\/\S+"
  | rex field=process "(?i)user\s+(?<target_account>[^\s]+)\s+\S+" | table _time,
  host, user process, process_*, parent_process, target_account | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- impact:account access removal
technique_id: 
- T1531
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1531/T1531.md#atomic-test-1---change-user-password---windows
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/what-you-need-to-know-about-the-lockergoga-ransomware

name: Azure AD Multiple AppIDs and UserAgents Authentication Spike
id: 5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
version: 14
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. It leverages Azure AD audit logs, focusing on authentication events and using statistical thresholds. This behavior is significant as it may indicate an adversary probing for MFA requirements. If confirmed malicious, it suggests a compromised account, potentially leading to further exploitation, lateral movement, and data exfiltration. Early detection is crucial to prevent substantial harm.
data_source:
    - Azure Active Directory Sign-in activity
search: |-
    `azure_monitor_aad` category=SignInLogs operationName="Sign-in activity" (properties.authenticationRequirement="multiFactorAuthentication" properties.status.additionalDetails="MFA required in Azure AD") OR (properties.authenticationRequirement=singleFactorAuthentication "properties.authenticationDetails{}.succeeded"=true)
      | bucket span=5m _time
      | rename properties.* as *
      | rename userAgent as user_agent
      | fillnull
      | stats count dc(appId) as unique_app_ids dc(user_agent) as unique_user_agents min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(user_agent) as user_agent
        BY user src vendor_account
           vendor_product signature
      | where count > 5 and unique_app_ids > 2 and unique_user_agents > 5
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_multiple_appids_and_useragents_authentication_spike_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
    - https://github.com/dafthack/MFASweep
    - https://www.youtube.com/watch?v=SK1zgqaAZ2E
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ authenticated in a short periof of time with more than 5 different user agents across 3 or more unique application ids.
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Azure AD New Custom Domain Added
id: 30c47f45-dd6a-4720-9963-0bca6c8686ef
version: 13
creation_date: '2022-09-02'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a new custom domain within an Azure Active Directory (AD) tenant. It leverages Azure AD AuditLogs to identify successful "Add unverified domain" operations. This activity is significant as it may indicate an adversary attempting to establish persistence by setting up identity federation backdoors, allowing them to impersonate users and bypass authentication mechanisms. If confirmed malicious, this could enable attackers to gain unauthorized access, escalate privileges, and maintain long-term access to the Azure AD environment, posing a severe security risk.
data_source:
    - Azure Active Directory Add unverified domain
search: |-
    `azure_monitor_aad` operationName="Add unverified domain" properties.result=success
      | rename properties.* as *
      | rename targetResources{}.displayName as domain
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           domain signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_new_custom_domain_added_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-manage
    - https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
    - https://o365blog.com/post/federation-vulnerability/
    - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
    - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
    - https://attack.mitre.org/techniques/T1484/002/
finding:
    title: A new custom domain, $domain$ , was added by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Azure Active Directory
mitre_attack_id:
    - T1484.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Secure Firewall - Oracle E-Business Suite Exploitation
id: 1c077b8a-95a3-4692-980d-c72fc50e9930
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884.
    SIDs 65413-65415 detect detect Java.Backdoor.Cl0p variant payload downloads and Java.Backdoor.Cl0p outbound
    command-and-control connection attempts.
    SIDs 65456, 65377 and 65378 detect attempts to exploit these vulnerabilities.
    Security teams should investigate any instances of these signatures, especially if they are found in conjunction with other suspicious network activity or on systems that should not be exposed to such threats.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall`
    EventType=IntrusionEvent
    signature_id IN (65377, 65378, 65413, 65414, 65415, 65456)
    | fillnull
    | stats values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
      by src dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___oracle_e_business_suite_exploitation_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be unlikely.
references:
    - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
    - https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
    - https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
    - https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
finding:
    title: Network activity associated with Oracle E-Business Suite exploitation detected from source IP $src$ to destination IP $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Oracle E-Business Suite Exploitation
asset_type: Network
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

id: '27060.49391'
title: DLL Called with RS32
description: Threat actors including Qbot have been observed using rundll32.exe to
  invoke the RS32 function during post-compromise activity. This use case detects
  DLL files invoking RS32 , accounting for instances where rundll32.exe has been renamed.
  While these exexcutions may be legitimate, unexpected executions should be investigated.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ".dll" "RS32" | where match(process, "(?i)\.dll\,RS32") | table
  _time, host, user, process, process_*, parent_process, parent_process_*, called_function
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- PowerShell logs
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '27166.49583'
title: DLLRegisterServer Called from Command Line
description: Threat actors including SocGhoulish may use explicit calls to DLLRegisterServer
  in the command line as a technique to register malicious DLLs, often bypassing standard
  registration methods like regsvr32. This use case detects instances where any process,
  including those masquerading as legitimate system utilities, explicitly invokes
  DLLRegisterServer in the command line. While such executions could be part of legitimate
  software installations or development activities, unexpected executions should be
  investigated.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ".dll" "DLLRegisterServer" | where match(process, "(?i)\.dll\"?,DLLRegisterServer")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/lolbins-abuse/

name: ICACLS Grant Command
id: b1b1e316-accc-11eb-a9b4-acde48001122
version: 14
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the use of the ICACLS command to grant
    additional access permissions to files or directories. It leverages data from Endpoint
    Detection and Response (EDR) agents, focusing on specific process names and command-line
    arguments. This activity is significant because it is commonly used by Advanced
    Persistent Threats (APTs) and coinminer scripts to evade detection and maintain
    control over compromised systems. If confirmed malicious, this behavior could allow
    attackers to manipulate file permissions, potentially leading to unauthorized access,
    data exfiltration, or further system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
    Processes.process IN ("*/grant*", "*/g:*", "*/g *")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `icacls_grant_command_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$
        - field: user
          type: user
          score: 20
          message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$
analytic_story:
    - Ransomware
    - Crypto Stealer
    - XMRig
    - Defense Evasion or Unauthorized Access Via SDDL Tampering
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1222
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ivanti VTM New Account Creation
id: b04be6e5-2002-4349-8742-52285635b8f5
version: 9
creation_date: '2024-08-20'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
data_source:
    - Ivanti VTM Audit
search: |-
    `ivanti_vtm_audit` OPERATION="adduser" MODGROUP="admin" IP="!!ABSENT!!"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY IP, MODUSER, OPERATION,
           MODGROUP, AUTH
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `ivanti_vtm_new_account_creation_filter`
how_to_implement: To implement this detection, ensure that Ivanti vTM audit logs are being ingested into Splunk. Configure the Ivanti vTM to send its audit logs to Splunk via syslog or by monitoring the log files directly. The sourcetype should be set to "ivanti_vtm_audit" or a similar custom sourcetype for these logs.
known_false_positives: Legitimate new account creation by authorized administrators will generate similar log entries. However, those should include proper authentication details. Verify any detected events against expected administrative activities and authorized user lists.
references:
    - https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
finding:
    title: A new administrator account, $MODUSER$, was created on Ivanti vTM device without proper authentication, which may indicate exploitation of CVE-2024-7593.
    entity:
        field: MODUSER
        type: user
        score: 50
analytic_story:
    - Ivanti Virtual Traffic Manager CVE-2024-7593
    - Scattered Lapsus$ Hunters
    - Hellcat Ransomware
asset_type: Web Application
cve:
    - CVE-2024-7593
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

name: Kubernetes Previously Unseen Container Image Name
id: fea515a4-b1d8-4cd6-80d6-e0d71397b891
version: 10
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Matthew Moore, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies the creation of containerized workloads using previously unseen images in a Kubernetes cluster. It leverages process metrics from an OTEL collector and Kubernetes cluster receiver, pulled from Splunk Observability Cloud. The detection compares container image names seen in the last hour with those from the previous 30 days. This activity is significant as unfamiliar container images may introduce vulnerabilities, malware, or misconfigurations, posing threats to the cluster's integrity. If confirmed malicious, compromised images can lead to data breaches, service disruptions, unauthorized access, and potential lateral movement within the cluster.
data_source: []
search: |-
    | mstats  count(k8s.container.ready) as k8s.container.ready_count where `kubernetes_metrics` AND earliest=-24h by host.name k8s.cluster.name k8s.node.name container.image.name
    | eval current="True"
    | append [mstats  count(k8s.container.ready) as k8s.container.ready_count where `kubernetes_metrics` AND earliest=-30d latest=-1h  by host.name k8s.cluster.name k8s.node.name container.image.name
    | eval current="false" ]
    | stats values(current) as current
      BY host.name k8s.cluster.name k8s.node.name
         container.image.name
    | search current="true" AND current!="false"
    | rename host.name as host
    | `kubernetes_previously_unseen_container_image_name_filter`
how_to_implement: "To implement this detection, follow these steps:\n* Deploy the OpenTelemetry Collector (OTEL) to your Kubernetes cluster.\n* Enable the hostmetrics/process receiver in the OTEL configuration.\n* Ensure that the process metrics, specifically Process.cpu.utilization and process.memory.utilization, are enabled.\n* Install the Splunk Infrastructure Monitoring (SIM) add-on. (ref: https://splunkbase.splunk.com/app/5247)\n * Configure the SIM add-on with your Observability Cloud Organization ID and Access Token.\n* Set up the SIM modular input to ingest Process Metrics. Name this input \"sim_process_metrics_to_metrics_index\".\n* In the SIM configuration, set the Organization ID to your Observability Cloud Organization ID.\n* Set the Signal Flow Program to the following: data('process.threads').publish(label='A'); data('process.cpu.utilization').publish(label='B'); data('process.cpu.time').publish(label='C'); data('process.disk.io').publish(label='D'); data('process.memory.usage').publish(label='E'); data('process.memory.virtual').publish(label='F'); data('process.memory.utilization').publish(label='G'); data('process.cpu.utilization').publish(label='H'); data('process.disk.operations').publish(label='I'); data('process.handles').publish(label='J'); data('process.threads').publish(label='K')\n* Set the Metric Resolution to 10000.\n * Leave all other settings at their default values.\n* Run the Search Baseline Of Kubernetes Container Network IO Ratio"
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/signalfx/splunk-otel-collector-chart
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Kubernetes Previously Unseen Container Image Name on host $host$
analytic_story:
    - Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring
asset_type: Kubernetes
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Nopasswd Entry In Sudoers File
id: 651df959-ad17-4b73-a323-90cb96d5fa1b
version: 12
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. It leverages Linux Auditd data to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized privilege escalation, persistent access, and potential compromise of sensitive data and system integrity.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd` proctitle = "*NOPASSWD*"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_nopasswd_entry_in_sudoers_file_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
    - https://help.ubuntu.com/community/Sudoers
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to add NOPASSWD entry in sudoers file.
analytic_story:
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Emacs Privilege Escalation
id: 92033cab-1871-483d-a03b-a7ce98665cfc
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of Emacs with elevated privileges using the `sudo` command and the `--eval` option. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line arguments. This activity is significant because it indicates a potential privilege escalation attempt, where a user could gain root access by running Emacs with elevated permissions. If confirmed malicious, this could allow an attacker to execute arbitrary commands as root, leading to full system compromise and unauthorized access to sensitive information.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*emacs*"
        AND
        Processes.process="*--eval*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_emacs_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/emacs/
    - https://en.wikipedia.org/wiki/Emacs
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS plutil
id: c11f2b57-92c1-4cd2-b46c-064eafb833ac
version: 11
creation_date: '2022-03-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the usage of the `plutil` command to modify plist files on macOS systems. It leverages osquery to monitor process events, specifically looking for executions of `/usr/bin/plutil`. This activity is significant because adversaries can use `plutil` to alter plist files, potentially adding malicious binaries or command-line arguments that execute upon user logon or system startup. If confirmed malicious, this could allow attackers to achieve persistence, execute arbitrary code, or escalate privileges, posing a significant threat to the system's security.
data_source:
    - Osquery Results
search: "`osquery_macro` name=es_process_events columns.path=/usr/bin/plutil\n  | rename columns.* as *\n  | stats count  min(_time) as firstTime max(_time) as lastTime\n    BY username host cmdline\n       pid path parent\n       signing_id\n  | rename username as user, cmdline as process, path as process_path, host as dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `macos_plutil_filter`"
how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: Administrators using plutil to change plist files.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
finding:
    title: plutil are executed on $dest$ from $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: plutil are executed on $dest$ from $user$
analytic_story:
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1647
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Ollama Abnormal Service Crash Availability Attack
id: 327fa152-9b56-4e4e-bc0b-2795d4068afa
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability.
data_source:
    - Ollama Server
search: '`ollama_server` (level=ERROR OR level=FATAL OR "service stopped" OR "terminated" OR "exit" OR "shutdown" OR "crash" OR "killed") | rex field=_raw "msg=\"(?<msg>[^\"]+)\"" | rex field=_raw "exit_code=(?<exit_code>\d+)" | bin _time span=5m | stats count as termination_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(msg) as error_messages, values(exit_code) as exit_codes, dc(msg) as unique_errors by host | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") | eval severity=case( termination_count > 5, "critical", termination_count > 2, "high", 1=1, "medium" ) | eval attack_type=case( termination_count > 5, "Resource Exhaustion", termination_count > 2, "Repeated Service Failures", 1=1, "Service Instability" ) | where termination_count > 1 | table first_seen, last_seen, host, termination_count, unique_errors, error_messages, severity, attack_type | `ollama_abnormal_service_crash_availability_attack_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Normal service restarts during system updates or maintenance windows, graceful shutdowns with non-zero exit codes, intentional service stops by administrators, software upgrades requiring process termination, out-of-memory conditions on resource-constrained systems, or known bugs in specific Ollama versions that cause benign crashes may trigger this detection during routine operations.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: 'Abnormal Ollama service termination detected on host $host$ between $first_seen$ and $last_seen$. Service stopped $termination_count$ times with $unique_errors$ unique error types. Severity: $severity$. Potential cause: $attack_type$. Error messages: $error_messages$ require investigation.'
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '29624.53381'
title: QEMU Network Tunneling - Windows
description: 'QEMU is an open-source machine emulator that allows for running multiple
  operating systems as separate processes. The use of QEMU executions with specific
  networking commands may indicate attempts at network tunneling or bypassing security
  controls, which was observed in intrusion reported on SecureList. This use case
  detects QEMU executions with command-line arguments that could be used to tunnel
  traffic. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "qemu-system-" ("-net " OR "-netdev" OR "-redir" OR "socket" OR "listen" OR "-device"
  OR "hostfwd=") | table _time, host, user, process, process_*, parent_process_name,
  parent_process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:protocol tunneling
- command-and-control:non-application layer protocol
technique_id: 
- T1572
- T1095
data_category:
- Windows Sysmon
references:
- https://securelist.com/network-tunneling-with-qemu/111803/

name: Remote WMI Command Attempt
id: 272df6de-61f1-4784-877c-1fbc3e2d0838
version: 13
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Rico Valdez, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `wmic.exe` with the `node` switch, indicating an attempt to spawn a local or remote process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, the attacker could gain remote control over the targeted system, execute arbitrary commands, and potentially escalate privileges or persist within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic` Processes.process=*node*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_wmi_command_attempt_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may use this legitimately to gather info from remote systems. Filter as needed.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
finding:
    title: A wmic.exe process $process$ contain node commandline $process$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A wmic.exe process $process$ contain node commandline $process$ in host $dest$
analytic_story:
    - Graceful Wipe Out Attack
    - Volt Typhoon
    - Living Off The Land
    - IcedID
    - Suspicious WMI Use
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: UAC Bypass MMC Load Unsigned Dll
id: 7f04349c-e30d-11eb-bc7f-acde48001122
version: 11
creation_date: '2021-07-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the loading of an unsigned DLL by the MMC.exe application, which is indicative of a potential UAC bypass or privilege escalation attempt. It leverages Sysmon EventCode 7 to identify instances where MMC.exe loads a non-Microsoft, unsigned DLL. This activity is significant because attackers often use this technique to modify CLSID registry entries, causing MMC.exe to load malicious DLLs, thereby bypassing User Account Control (UAC) and gaining elevated privileges. If confirmed malicious, this could allow an attacker to execute arbitrary code with higher privileges, leading to further system compromise and persistence.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7  ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time. dll.
references:
    - https://offsec.almond.consulting/UAC-bypass-dotnet.html
finding:
    title: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1218.014
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Privileged Account SID History Addition
id: 6b521149-b91c-43aa-ba97-c2cac59ec830
version: 13
creation_date: '2023-04-11'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: The following analytic identifies when the SID of a privileged user is added to the SID History attribute of another user. It leverages Windows Security Event Codes 4742 and 4738, combined with identity lookups, to detect this activity. This behavior is significant as it may indicate an attempt to abuse SID history for unauthorized access across multiple domains. If confirmed malicious, this activity could allow an attacker to escalate privileges or maintain persistent access within the environment, posing a significant security risk.
data_source:
    - Windows Event Log Security 4742
    - Windows Event Log Security 4738
search: |-
    `wineventlog_security`
    EventCode IN (4742, 4738)
    NOT SidHistory IN ("%%1793", -)
    | rex field=SidHistory "(^%{|^)(?P<SidHistory>.*?)(}$|$)"
    | eval category="privileged"
    | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match
    | where isnotnull(match)
    | rename TargetSid as userSid
    | table _time action status host user userSid SidHistory Logon_ID src_user dest
    | `windows_ad_privileged_account_sid_history_addition_filter`
how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` added to the identity field of your Asset and Identities lookup, along with the category of privileged for the applicable users. Ensure you are ingesting eventcodes 4742 and 4738. Two advanced audit policies `Audit User Account Management` and `Audit Computer Account Management` under `Account Management` are required to generate these event codes.
known_false_positives: Migration of privileged accounts.
references:
    - https://adsecurity.org/?p=1772
finding:
    title: A Privileged User Account SID History Attribute was added to $userSid$ by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1134.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Defender ASR or Threat Configuration Tamper
id: d0c07718-19d1-4de2-aea9-e0ffff0ed986
version: 6
creation_date: '2021-11-25'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the use of commands to disable Attack Surface Reduction (ASR) rules or change threat default actions in Windows Defender.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "Add-MpPreference" or "Set-MpPreference".
    This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute undetected.
    If confirmed malicious, this behavior could enable attackers to evade antivirus detection, maintain persistence, and execute further malicious activities without interference from Windows Defender.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process IN ("*Add-MpPreference *", "*Set-MpPreference *")

    Processes.process IN (
          "*-AttackSurfaceReductionRules_Actions*",
          "*-ThreatIDDefaultAction_Actions*"
          )

    Processes.process IN (
          "*Allow*",
          "*NoAction*",
          "*Disabled*",
          "*_Actions 6*",
          "*_Actions 9*",
          "*_Actions 0*")

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_defender_asr_or_threat_configuration_tamper_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    Certain administrative tasks may require the modification of ASR rules or threat actions due to FPs being generated. Investigate all attempts and filter as needed.
references:
    - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2025-ps#-attacksurfacereductionrules-actions
    - https://www.virustotal.com/gui/file/7e805617c313ec2fb59d86719c827074cb7dfbf8f0aa18194ac1ffe6c21c8967/behavior
finding:
    title: ASR or Threat detection tamper activity executed via $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: ASR or Threat detection tamper activity executed via $process$ on $dest$
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Firewall Rule Modification
id: fe7efbf7-5f82-44b9-8c33-316189ab2393
version: 8
creation_date: '2025-03-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.
data_source:
    - Windows Event Log Security 4947
search: |-
    `wineventlog_security` EventCode=4947
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY RuleName signature subject
           status dest ProcessID
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_firewall_rule_modification_filter`
how_to_implement: This detection is based on data collected from Endpoint Detection and Response (EDR) agents, which provide security-related telemetry from monitored endpoints. Specifically, it focuses on Windows Security Event Log entries with EventID 4947, which indicates that a Windows Firewall rule has been modified. To implement this detection in Splunk, you must ingest Windows Security Event Logs that capture EventID 4947, ensuring that critical fields such as _time, EventRecordID, ProcessID, ThreadID, Computer, ProfileChanged, RuleName, and RuleId are available for analysis. These logs must be processed using the appropriate Splunk Technology Add-ons (TAs) to ensure compatibility with the EDR product and proper field extraction. Additionally, mapping these logs to the appropriate data model, such as the Endpoint data model, enhances structured analysis. Leveraging the Splunk Common Information Model (CIM) helps normalize field names, ensuring consistency across different data sources. By implementing this approach, you can effectively detect and monitor Windows Firewall rule modifications, providing visibility into potential security risks or unauthorized changes.
known_false_positives: Legitimate admin changes, Group Policy updates, software installs, security tools, and automated scripts can trigger false positives for Event ID 4947.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4947
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a firewall rule $RuleName$ has been modified on $dest$.
analytic_story:
    - ShrinkLocker
    - Medusa Ransomware
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MSC EvilTwin Directory Path Manipulation
id: 7f6b8a95-3fb7-429a-8c53-e5d4f8d92a10
version: 7
creation_date: '2025-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects potential MSC EvilTwin loader exploitation, which manipulates directory paths with spaces to bypass security controls. The technique, described as CVE-2025-26633, involves crafting malicious MSC files that leverage MUIPath parameter manipulation. This detection focuses on suspicious MSC file execution patterns with unconventional command-line parameters, particularly those containing unusual spaces in Windows System32 paths or suspicious additional parameters after the MSC file. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code with elevated privileges through DLL side-loading or path traversal techniques.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="mmc.exe" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_id Processes.process_name Processes.process_path Processes.action Processes.original_file_name Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_integrity_level Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*mmc\.exe.*((Windows\s+\\\\System32)|(Windows\s+System32)|(\\\\Windows\s+\\\\System32)|(Program\s+Files\s+\\\\)|(Program\s+Files\s+\(\\w+\)\s+\\\\)|(Progra~1\s+\\\\))" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msc_eviltwin_directory_path_manipulation_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate system maintenance tools might use MSC files with unusual parameters. Filter for specific known maintenance activities in your environment.
references:
    - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/
    - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024
finding:
    title: Process $process_name$ executed an MSC file with suspicious directory path manipulation on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process
analytic_story:
    - Water Gamayun
    - Windows Defense Evasion Tactics
    - Living Off The Land
asset_type: Endpoint
cve:
    - CVE-2025-26633
mitre_attack_id:
    - T1218
    - T1036.005
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Suspicious Named Pipe
id: 3a76d52f-a007-4a65-a37d-f313c2c83f31
version: 5
creation_date: '2025-12-08'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |
    The following analytic detects the creation or connection to known suspicious named pipes.
    It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by malicious or suspicious tools.
    If confirmed malicious, this could allow an attacker to abuse these to potentially gain privilege escalation,
    persistence, c2 communications, or further system compromise.
data_source:
    - Sysmon EventID 17
    - Sysmon EventID 18
search: |
    `sysmon`
    EventCode IN (17, 18)
    NOT process_path IN (
        "*:\\Program Files \(x86\)\\Adobe*",
        "*:\\Program Files \(x86\)\\Google*",
        "*:\\Program Files \(x86\)\\Microsoft*",
        "*:\\Program Files\\Adobe*",
        "*:\\Program Files\\Google*",
        "*:\\Program Files\\Microsoft*",
        "*:\\Windows\\system32\\SearchIndexer.exe",
        "*:\\Windows\\System32\\svchost.exe",
        "*:\\Windows\\SystemApps\\Microsoft*",
        "*\\Amazon\\SSM\\Instance*",
        "*\\AppData\\Local\\Google*",
        "*\\AppData\\Local\\Kingsoft\\*",
        "*\\AppData\\Local\\Microsoft*",
        "System",
    )

    | stats min(_time) as firstTime max(_time) as lastTime
      count by dest dvc process_exec process_guid process_id process_path
               pipe_name user_id process_name signature signature_id vendor_product

    | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description
    | where isnotnull(tool)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_suspicious_named_pipe_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting
    logs with the process name and pipename from your endpoints. If you are using Sysmon,
    you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: |
    False positives should be rare, investigate matches and apply additional filters as needed.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
finding:
    title: An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing known suspicious named pipe $pipe_name$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - BlackByte Ransomware
    - Brute Ratel C4
    - Cobalt Strike
    - DarkSide Ransomware
    - Gozi Malware
    - Graceful Wipe Out Attack
    - Hellcat Ransomware
    - LockBit Ransomware
    - Meterpreter
    - Remote Monitoring and Management Software
    - Trickbot
    - Tuoni
asset_type: Endpoint
mitre_attack_id:
    - T1559
    - T1021.002
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint