Splunk rules: 2o

name: AWS IAM Failure Group Deletion
id: 723b861a-92eb-11eb-93b8-acde48001122
version: 12
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or AccessDenied. This activity is significant as it may indicate unauthorized attempts to modify IAM group configurations, which could be a precursor to privilege escalation or other malicious actions. If confirmed malicious, this could allow an attacker to disrupt IAM policies, potentially leading to unauthorized access or denial of service within the AWS environment.
data_source:
    - AWS CloudTrail DeleteGroup
search: |-
    `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_iam_failure_group_deletion_filter`
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
references:
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ has had mulitple failures while attempting to delete groups from $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: Cisco Secure Firewall - Repeated Malware Downloads
id: aeff2bb5-3483-48d4-9be8-c8976194be1e
version: 10
creation_date: '2025-04-09'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies `FileEvent` events with a `SHA_Disposition` of "Malware" and `FileDirection` set to "Download". If ten or more such events occur from the same host within five minutes, this analytic will trigger. This activity may indicate the host is compromised and repeatedly retrieving malicious content either due to command-and-control, malware staging, or automation. If confirmed malicious, this behavior may represent an infection in progress, persistence mechanism, or a malicious downloader.
data_source:
    - Cisco Secure Firewall Threat Defense File Event
search: |
    `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download"
    | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
    | bin _time span=5m
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(uri) as uri
            values(ClientApplication) as ClientApplication
            values(app) as app
            values(file_hash) as file_hash
            values(SHA_Disposition) as SHA_Disposition
            values(file_name) as file_name
            values(ThreatName) as ThreatName
            values(dest) as dest
            values(dest_port) as dest_port
            by src FileDirection FileType Description
    | where count >= 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication ThreatName SHA_Disposition
    | `cisco_secure_firewall___repeated_malware_downloads_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: False positives should be minimal here, tuning may be required to exclude known test machines or development hosts.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Repeated malware file downloads detected from $src$ involving $ThreatName$.
threat_objects:
    - field: file_hash
      type: file_hash
    - field: file_name
      type: file_name
analytic_story:
    - Hellcat Ransomware
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1105
    - T1027
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

id: '31193.55842'
title: ConsentPromptBehaviorAdmin Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. The impact to the
  user ranges from denying the operation under high enforcement to allowing the user
  to perform the action if they are in the local administrators group and click through
  the prompt or allowing them to enter an administrator password to complete the action.
  This use case detects registry modification events or process executions with registry
  modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin.
  -- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
  "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=13) OR "<EventID>13<"))
  "ConsentPromptBehaviorAdmin" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user, process, parent_process_name, signature_id, process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-22---disable-uac-admin-consent-prompt-via-consentpromptbehavioradmin-registry-key
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base

name: DSQuery Domain Discovery
id: cc316032-924a-11eb-91a2-acde48001122
version: 13
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line arguments. This activity is significant as it often indicates domain trust discovery, a common step in lateral movement or privilege escalation by adversaries. If confirmed malicious, this could allow attackers to map domain trusts, potentially leading to further exploitation and unauthorized access to trusted domains.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=dsquery.exe Processes.process=*trustedDomain*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `dsquery_domain_discovery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives. If there is a true false positive, filter based on command-line or parent process.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
    - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11)
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - Domain Trust Discovery
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Loghost Config Tampering
id: 64bc2fa3-c493-44b4-8e94-3e5dbf71377e
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies changes to the syslog loghost configuration on an ESXi host, which may indicate an attempt to disrupt log forwarding and evade detection.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*Set called with key*" AND Message IN ("*Syslog.global.logHost*","*Syslog.global.logdir*") | rex field=_raw "key ''(?<key>[^'']+)'', value ''\"(?<value>[^\"]+)\"''" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest key value | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_loghost_config_tampering_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed
finding:
    title: Syslog destination was modified on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '8150.10002'
title: Fsutil fsinfo execution
description: 'Adversaries may attempt to gather information about attached peripheral
  devices and components connected to a computer system. Peripheral devices could
  include auxiliary resources that support a variety of functionalities such as keyboards,
  printers, cameras, smart card readers, or removable storage. This use case looks
  for when fsutil is executed with fsinfo. - Threat Actor Association: APT29/Nobelium/Cozy
  Bear - Software Association: Alphv/BlackCat'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "fsutil" TERM(fsinfo) | table _time, host, user
  process, process_*, signature_id, parent_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- discovery:peripheral device discovery
technique_id: 
- T1120
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf

name: GetWmiObject Ds Group with PowerShell Script Block
id: 67740bd3-1506-469c-b91d-effc322cc6e5
version: 12
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-WmiObject` commandlet with the `DS_Group` parameter via PowerShell Script Block Logging (EventCode=4104). This method leverages WMI to query all domain groups. Monitoring this activity is crucial as adversaries and Red Teams may use it for domain group enumeration, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map out the domain structure, potentially leading to further exploitation and privilege escalation within the network.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`getwmiobject_ds_group_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
finding:
    title: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '29435.53027'
title: PowerShell DownloadFile_DownloadString
description: Adversaries have the capability to move tools or files from an external
  system into a compromised environment. This involves copying tools or files from
  an external system controlled by the adversary to the victim network through the
  command and control channel. This use case detects PowerShell commands related to
  file downloads using DownloadFile and DownloadString methods. Executions involving
  Invoke-WebRequest and Invoke-Expression have been excluded as they are covered by
  other use cases.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("downloadfile" OR "downloadstring") "System.Net.WebClient"
  NOT ("Invoke-WebRequest" OR "Invoke-Expression") | regex process="(?i)System\.Net\.WebClient.+\.Download(file|string)"|
  regex process!="(?i)(^|\s|\;|\|)(iex|iwr)(\s|\;|\|)"| table _time, host, user, process,
  process_name, parent_process_name | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter
- command-and-control:ingress tool transfer
technique_id:
- T1059.001
- T1059
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://blog.talosintelligence.com/prometei-botnet-improves/

id: '22461.40120'
title: Remote Thread Created by Uncommon Process
description: Remote thread creation involves a process initiating a thread within
  the address space of another process. While this activity can occur during normal
  system operation, threat actors may abuse remote threads to attempt privilege escalation,
  defense evasion, or code injection. This use case detects remote threads created
  by LOLBINs that do not typically create remote threads. Some known benign combinations
  of source and target images have been filtered out to reduce noise. Sysmon event
  8 logging is required for detection. LOLBINS/LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=8) OR "<EventID>8<")
  ("bash.exe" OR "cscript.exe" OR "cvtres.exe" OR "defrag.exe" OR "dnx.exe" OR "esentutl.exe"
  OR "excel.exe" OR "expand.exe" OR "explorer.exe" OR "find.exe" OR "findstr.exe"
  OR "forfiles.exe" OR "gpupdate.exe" OR "hh.exe" OR "iexplore.exe" OR "installutil.exe"
  OR "lync.exe" OR "makecab.exe" OR "mDNSResponder.exe" OR "monitoringhost.exe" OR
  "msbuild.exe" OR "mshta.exe" OR "msiexec.exe" OR "mspaint.exe" OR "outlook.exe"
  OR "ping.exe" OR "powerpnt.exe" OR "provtool.exe" OR "python.exe" OR "regsvr32.exe"
  OR "robocopy.exe" OR "runonce.exe" OR "sapcimc.exe" OR "schtasks.exe" OR "smartscreen.exe"
  OR "spoolsv.exe" OR "tstheme.exe" OR "userinit.exe" OR "vssadmin.exe" OR "vssvc.exe"
  OR "w3wp.exe" OR "winlogon.exe" OR "winscp.exe" OR "winword.exe" OR "wmic.exe" OR
  "wscript.exe") | rex field=SourceImage "\x5c(?<source_image>[^\x5c]+)$"| rex field=TargetImage
  "\x5c(?<target_image>[^\x5c]+)$"| regex source_image="(?i)(bash|cscript|cvtres|defrag|dnx|esentutl|excel|expand|explorer|find|findstr|forfiles|gpupdate|hh|iexplore|installutil|lync|makecab|mDNSResponder|monitoringhost|msbuild|mshta|msiexec|mspaint|outlook|ping|powerpnt|provtool|python|regsvr32|robocopy|runonce|sapcimc|schtasks|smartscreen|spoolsv|tstheme|userinit|vssadmin|vssvc|w3wp|winlogon|winscp|winword|wmic|wscript)\.exe"|
  where NOT ((match(source_image, "(?i)\x5cwinlogon\.exe") AND match(target_image,
  "(?i)\x5c(services|wininit|csrss)\.exe")) OR (match(source_image, "(?i)\x5cwinlogon\.exe")
  AND TargetParentImage="System" AND TargetParentProcessId=4) OR (match(source_image,
  "(?i)\x5cprovtool\.exe") AND TargetParentProcessId=0) OR (match(source_image, "(?i)\x5cVSSVC\.exe")
  AND match(target_image, "System")) OR (match(source_image, "(?i)\x5cschtasks\.exe")
  AND match(target_image, "(?i)\x5cconhost\.exe")) OR (match(source_image, "(?i)\x5cexplorer\.exe")
  AND match(target_image, "(?i)\x5cNVIDIA\sGeForce\sExperience\.exe"))) | table _time,
  host, user host, process, process_*, parent_process_*, source_image, target_image
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:process injection
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Windows Sysmon
references:
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/create_remote_thread/create_remote_thread_win_uncommon_source_image.yml
- https://lolbas-project.github.io

name: Windows Access Token Manipulation SeDebugPrivilege
id: 6ece9ed0-5f92-4315-889d-48560472b188
version: 24
creation_date: '2022-09-05'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.
data_source:
    - Windows Event Log Security 4703
search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required.
known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
    - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
    - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
    - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
intermediate_findings:
    entities:
        - field: Computer
          type: system
          score: 20
          message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$.
analytic_story:
    - Meduza Stealer
    - PlugX
    - CISA AA23-347A
    - China-Nexus Threat Activity
    - AsyncRAT
    - SnappyBee
    - Derusbi
    - WinDealer RAT
    - Salt Typhoon
    - DarkGate Malware
    - ValleyRAT
    - Brute Ratel C4
    - PathWiper
    - GhostRedirector IIS Module and Rungan Backdoor
    - Lokibot
    - Scattered Lapsus$ Hunters
    - Tuoni
    - Gh0st RAT
    - Salat Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1134.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Command and Scripting Interpreter Hunting Path Traversal
id: d0026380-b3c4-4da0-ac8e-02790063ff6b
version: 8
creation_date: '2022-05-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Michael Haag, Splunk
status: production
type: Hunting
description: |
    The following analytic identifies path traversal command-line executions,
    leveraging data from Endpoint Detection and Response (EDR) agents. It detects patterns
    in command-line arguments indicative of path traversal techniques, such as multiple
    instances of "/..", "\..", or "\\..". This activity is significant as it often indicates
    attempts to evade defenses by executing malicious code, such as through msdt.exe.
    If confirmed malicious, this behavior could allow attackers to execute arbitrary
    code, potentially leading to system compromise, data exfiltration, or further lateral
    movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime FROM datamodel=Endpoint.Processes where
    Processes.process IN ("*\\..*", "*//..*", "*\..*", "*/..*")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1)
    | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1)
    | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1)
    | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1)

    | search count_of_pattern1 > 1
             OR
             count_of_pattern2 > 1
             OR
             count_of_pattern3 > 1
             OR
             count_of_pattern4 > 1
    | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives may vary depending on the score you want to check.
references:
    - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
analytic_story:
    - Windows Defense Evasion Tactics
    - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1044.6368'
title: Windows Defender Disabled Detection
description: 'An attacker could disable security tools to avoid possible detection
  of their tools and activities. This can take the form of killing security software,
  real-time monitoring or Windows Defender Service. -- Threat Actor Association: FIN6,
  FIN11, Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm),
  Vice Society, Wizard Spider -- Software Association: Bazarloader, BianLian, Blackbyte,
  Black Basta, Clop, Conti, DirtyMoe, Lockbit, Sodinokibi/REvil, Vice Society, WhisperGates
  -- #TrendingThreat #Russia #Ukraine - Atomics T1588.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") ((TERM(-DisableRealtimeMonitoring) OR TERM(-drtm)) AND TERM(true))
  OR ((TERM(REG) OR "reg.exe") TERM(ADD) "windows defender" TERM(DisableAntiSpyware)
  "/d 1") OR ((TERM(sc) OR TERM(net) OR TERM(net1) OR "sc.exe" OR "net.exe" OR TERM(Stop-Service))
  TERM(windows) TERM(defender)) | table _time, host, user process, process_*, singature_id,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1562.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/swagkarna/Defeat-Defender

name: Windows Execute Arbitrary Commands with MSDT
id: e1d5145f-38fe-42b9-a5d5-457796715f97
version: 15
creation_date: '2022-05-30'
modification_date: '2026-05-13'
author: Michael Haag, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects arbitrary command execution using Windows msdt.exe, a Diagnostics Troubleshooting Wizard. It leverages Endpoint Detection and Response (EDR) data to identify instances where msdt.exe is invoked via the ms-msdt:/ protocol handler to retrieve a remote payload. This activity is significant as it can indicate an exploitation attempt leveraging msdt.exe to execute arbitrary commands, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*")
        AND
        (Processes.process="*IT_BrowseForFile=*"
        OR
        Processes.process="*IT_RebrowseForFile=*"
        OR
        Processes.process="*.xml*")
        AND
        Processes.process="*PCWDiagnostic*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_execute_arbitrary_commands_with_msdt_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
references:
    - https://isc.sans.edu/diary/rss/28694
    - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
    - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
    - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
    - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
    - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
finding:
    title: A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
asset_type: Endpoint
cve:
    - CVE-2022-30190
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Gdrive Binary Activity
id: 9e7bd7c8-1c08-496e-9ffe-fd84ceb322e7
version: 5
creation_date: '2022-12-06'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the 'gdrive' tool on a Windows host. This tool allows standard users to perform tasks associated with Google Drive via the command line. This is used by actors to stage tools as well as exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this could lead to compromise of systems or sensitive data being stolen.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="gdrive.exe"
            OR
            Processes.original_file_name="*gdrive.exe"
        )
        Processes.process IN  ("* download *", "* upload *", "* list*", "* update *", "* sync *", "* share *", "* account add*", "* drives *", "* files *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_gdrive_binary_activity_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
finding:
    title: An instance of $process_name$ was identified attempting to interact with Google Drive on endpoint $dest$ by $user$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - China-Nexus Threat Activity
asset_type: Endpoint
mitre_attack_id:
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Change Win Defender Throttle Rate
id: f7da5fca-9261-43de-a4d0-130dad1e4f4d
version: 11
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the ThrottleDetectionEventsRate registry setting in Windows Defender. It leverages data from the Endpoint.Registry datamodel to identify changes in the registry path related to Windows Defender's event logging rate. This activity is significant because altering the ThrottleDetectionEventsRate can reduce the frequency of logged detection events, potentially masking malicious activities. If confirmed malicious, this could allow an attacker to evade detection by decreasing the visibility of security events, thereby hindering incident response and forensic investigations.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\Consumers\\IPS\\ThrottleDetectionEventsRate" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_throttle_rate_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender ThrottleDetectionEventsRate feature was modified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Image Load
id: 041aaae4-03de-465c-b9cb-9ed0d1e10454
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects image load events where a process loads a file from a remote share path.
    This activity is significant because remote DLL or image loading can be abused for execution, defense evasion, or lateral movement while leaving the payload hosted on another system.
    If confirmed malicious, an attacker may be loading code into a local process from attacker-controlled infrastructure.
data_source:
    - Sysmon EventID 7
search: |-
    `sysmon`
    EventID=7
    ImageLoaded="\\\\*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec
         process_guid process_hash process_id process_name process_path
         service_dll_signature_exists service_dll_signature_verified signature_id user_id
         vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_remote_image_load_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate software updates or remote imaging tools may load images from shared folders. Filter these detections for approved applications to reduce false positives.
references:
    - https://thehackernews.com/2024/08/microsoft-reveals-four-openvpn-flaws.html
    - https://www.microsoft.com/en-us/security/blog/2024/08/08/chained-for-attack-openvpn-vulnerabilities-discovered-leading-to-rce-and-lpe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential remote image load activity observed on $dest$ via $ImageLoaded$.
analytic_story:
    - BlackByte Ransomware
    - Ransomware
    - LockBit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1129
    - T1059
    - T1068
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Stop By Deletion
id: 196ff536-58d9-4d1b-9686-b176b04e430b
version: 10
creation_date: '2022-06-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the use of `sc.exe` to delete a Windows service. It leverages Endpoint Detection and Response (EDR) data, focusing on process execution logs that capture command-line arguments. This activity is significant because adversaries often delete services to disable security mechanisms or critical system functions, aiding in evasion and persistence. If confirmed malicious, this action could lead to the termination of essential security services, allowing attackers to operate undetected and potentially escalate their privileges or maintain long-term access to the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name = sc.exe
            OR
            Processes.original_file_name = sc.exe
        )
        Processes.process="* delete *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_service_stop_by_deletion_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
references:
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
analytic_story:
    - Azorult
    - Graceful Wipe Out Attack
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM
id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4
version: 12
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies a source endpoint failing to authenticate multiple valid users using the NTLM protocol, potentially indicating a Password Spraying attack. It leverages Event 4776 from Domain Controllers, calculating the standard deviation for each host and applying the 3-sigma rule to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access and potential lateral movement within the network.
data_source:
    - Windows Event Log Security 4776
search: |-
    `wineventlog_security`  EventCode=4776 TargetUserName!=*$ Status=0xC000006A
      | bucket span=2m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
        BY _time, Workstation
      | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
        BY Workstation
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
      | search isOutlier=1
      | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
intermediate_findings:
    entities:
        - field: Workstation
          type: system
          score: 20
          message: Potential NTLM based password spraying attack from $Workstation$
analytic_story:
    - Active Directory Password Spraying
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5975.6319'
title: WMI subscription execution
description: 'Adversaries may establish persistence and elevate privileges by executing
  malicious content triggered by a Windows Management Instrumentation (WMI) event
  subscription. -- Threat Actor Association: APT29, Metador, Mustang Panda (aka. Stately
  Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), TA551 - Software Association:
  BumbleBee, TargetCompany, TrailBlazer, Trickbot -- Atomics T1047 Test#7 Atomics
  T1047 Test#8 Atomics T1047 Test#9 -- While this use case can detect the above atomics,
  it is not mapped to its MITRE execution techniques due to adversaries utilizing
  this method of WMI for Privilege-Escalation and Persistence.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") TERM(WmiPrvSE) | regex parent_process_name="(?i)(WmiPrvSE)" |
  table _time, host, user parent_*, process, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:windows management instrumentation event subscription
- execution:windows management instrumentation
- privilege-escalation:event triggered execution:windows management instrumentation
  event subscription
technique_id:
- T1546.003
- T1047
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/