Splunk rules: 2p

name: Cisco SD-WAN - Low Frequency Rogue Peer
id: 0fe052a5-07b8-48e7-9fc8-d6a3957eb914
version: 4
creation_date: '2026-03-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic identifies low-frequency Cisco SD-WAN control peering activity from control-connection-state-change events where "new-state:up".

    It extracts "peer-type" and "peer-system-ip", groups events by these two fields, and counts how often each combination appears within the selected time window.

    Combinations whose count is less than or equal to the defined threshold (currently <=3 occurrences in the search window) are flagged as rare.

    Analysts should prioritize peer identities that are rarely observed in the environment, particularly those involving unexpected peer-type roles or unfamiliar peer-system-ip values.
    Rare control-plane peers may indicate misconfiguration, unauthorized SD-WAN components, infrastructure drift, or potentially malicious control-plane connection attempts.

    Findings might indicate the potential exploitation of CVE-2026-20127.

    Note that the threshold setting is set to "3", but its highly recommended that this should be adapted to the environment before deploying this search.
data_source:
    - Cisco SD-WAN NTCE 1000001
search: |
    `cisco_sd_wan_syslog`
    TERM("*control-connection-state-change*")
    TERM("*new-state:up*")
    TERM("*peer-system-ip:*")
    TERM("*public-ip:*")
    | rex field=_raw "^(?<event_timestamp>(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?|[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.\d{1,6})?(?:Z|[+-][0-9]{2}:[0-9]{2})))\s*:?"
    | rex field=_raw "^(?:[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d{3})?\s*:?\s+)(?<prefix_host>[^\s:]+)\s+\S+(?:\[\d+\])?:\s+%"
    | eval dest=coalesce(prefix_host, legacy_host, device_name, host)
    | rex field=_raw "new-state:(?<new_state>\S+)"
    | rex field=_raw "peer-type:(?<peer_type>\S+)"
    | rex field=_raw "peer-system-ip:(?<peer_system_ip>\S+)"
    | rex field=_raw "public-ip:(?<public_ip>\S+)"
    | rex field=_raw "public-port:(?<public_port>\d+)"

    | where isnotnull(peer_type) AND isnotnull(peer_system_ip)

    | stats count
            values(dest) as dest
            values(public_ip) as public_ips
            values(public_port) as public_ports
      by peer_type peer_system_ip
    | where count <= 3
    | sort 0 count asc
    | table dest peer_type peer_system_ip public_ips
            public_ports count
    | `cisco_sd_wan___low_frequency_rogue_peer_filter`
how_to_implement: |
    This analytic requires Cisco SD-WAN/vSmart logs in Splunk and assumes control peering status
    messages are searchable via the `cisco_sd_wan_syslog` macro. Update that macro with your environment-specific index and sourcetype settings.
    Build a known-good baseline (lookup or macro conditions) for expected `peer-system-ip`, `public-ip`, and `peer-type` relationships, then tune the `cisco_sd_wan_rogue_peer_outlier_filter` macro to suppress approved peers and transport sources.
    The threshold (`<=3`) is a starting point and should be adjusted for your environment size and log
    volume.
    Follow the documentation https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging to start ingesting these logs.
known_false_positives: |
    New controller onboarding, topology expansion, controller failover, maintenance windows, and temporary transport.
    Path changes can create rare peer/public-IP combinations.
    Validate outliers against change records and known SD-WAN inventory before escalating.
references:
    - https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
    - https://blog.talosintelligence.com/uat-8616-sd-wan/
    - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/m-alarms-events-logs.html
    - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging
    - https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The SD-WAN device $dest$ established a rare control connection to peer-system-ip $peer_system_ip$ with peer-type $peer_type$ (observed $count$ times).
analytic_story:
    - Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
    - CVE-2026-20127
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: CrushFTP Max Simultaneous Users From IP
id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e
version: 5
creation_date: '2025-04-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
data_source:
    - CrushFTP
search: '`crushftp` "*User access not allowed.  Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`'
how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:user:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior.
known_false_positives: In environments where multiple users legitimately access CrushFTP from behind the same NAT or proxy, this may generate false positives. Tune the threshold based on your organization's usage patterns.
references:
    - https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31161
    - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
intermediate_findings:
    entities:
        - field: src_ip
          type: system
          score: 20
          message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$
analytic_story:
    - CrushFTP Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2025-31161
mitre_attack_id:
    - T1110.001
    - T1110.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Detect malicious requests to exploit JBoss servers
id: c8bff7a4-11ea-4416-a27d-c5bca472913d
version: 8
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic identifies malicious HTTP requests targeting the jmx-console in JBoss servers. It detects unusually long URLs, indicative of embedded payloads, by analyzing web server logs for GET or HEAD requests with specific URL patterns and lengths. This activity is significant as it may indicate an attempt to exploit JBoss vulnerabilities, potentially leading to unauthorized remote code execution. If confirmed malicious, attackers could gain control over the server, escalate privileges, and compromise sensitive data, posing a severe threat to the organization's security.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE (
            Web.http_method="GET"
            OR
            Web.http_method="HEAD"
        )
      BY Web.http_method, Web.url,Web.url_length Web.src,
         Web.dest
    | search Web.url="*jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin*import*" AND Web.url_length > 200
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table src, dest_ip, http_method, url, firstTime, lastTime
    | `detect_malicious_requests_to_exploit_jboss_servers_filter`
how_to_implement: You must ingest data from the web server or capture network data that contains web specific information with solutions such as Bro or Splunk Stream, and populating the Web data model
known_false_positives: No known false positives for this detection.
references: []
finding:
    title: Potentially malicious traffic exploiting JBoss servers [ $dest_ip$ ]
    entity:
        field: dest_ip
        type: system
        score: 50
analytic_story:
    - JBoss Vulnerability
    - SamSam Ransomware
asset_type: Web Server
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '29486.53151'
title: File Written to Startup Folder - Windows
description: Adversaries may achieve persistence by adding a program to a startup
  folder. Adding an entry to the startup folder will cause the program referenced
  to be executed when a user logs in. These programs will be executed under the context
  of the user and will have the account's associated permissions level. This use case
  detects file writes to \Microsoft\Windows\Start Menu\Programs\StartUp.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
  "<EventID>4656<") "%%4417") "Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
  | where !match(process_name, "(?i)wuauclt\.exe") and !match(ObjectName, "(?i)C:\x5c\$Windows\.~BT\x5cNewOS\x5c")
  | table _time, host, user, process, process_name, process_exec, ObjectName | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows event logs
references:
- https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration
- https://attack.mitre.org/techniques/T1547/001/
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml

id: '32307.57463'
title: Git Submodule Cloned - Windows
description: 'Adversaries may abuse a bug in Git whereby it can be fooled into writing
  files not into the submodule''s worktree but into a `.git/` directory. This allows
  writing a hook that will be executed while the clone operation is still running,
  giving the user no opportunity to inspect the code that is being executed. This
  use case detects when a submodule from a GitHub repository was cloned onto the system
  Vulnerability Association: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(git) OR TERM(gh)) TERM(submodule) TERM(clone)
  | table _time, host, user, process, process_path, signature_id, parent_process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002
- https://amalmurali.me/posts/git-rce/

name: Impacket Lateral Movement WMIExec Commandline Parameters
id: d6e464e4-5c6a-474e-82d2-aed616a3a492
version: 12
creation_date: '2021-11-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes spawned by `wmiprvse.exe` with command-line patterns indicative of Impacket usage. This activity is significant as Impacket tools are commonly used by adversaries for remote code execution and lateral movement within a network. If confirmed malicious, this could allow attackers to execute arbitrary commands on remote systems, potentially leading to further compromise and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process, "\\\\127\.0\.0\.1\\.*") AND match(process, "__\\d{1,10}\\.\\d{1,10}") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `impacket_lateral_movement_wmiexec_commandline_parameters_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://attack.mitre.org/techniques/T1021/003/
    - https://attack.mitre.org/techniques/T1047/
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/techniques/T1053/005/
    - https://github.com/SecureAuthCorp/impacket
    - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
finding:
    title: Suspicious command-line parameters on $dest$ may represent lateral movement using wmiexec.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - WhisperGate
    - Gozi Malware
    - Active Directory Lateral Movement
    - Volt Typhoon
    - Prestige Ransomware
    - Industroyer2
    - Data Destruction
    - Graceful Wipe Out Attack
    - Compromised Windows Host
    - CISA AA22-277A
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1021.002
    - T1021.003
    - T1047
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Microsoft Intune Mobile Apps
id: 98e6b389-2806-4426-a580-8a92cb0d9710
version: 5
creation_date: '2025-01-06'
modification_date: '2026-05-13'
author: Dean Luxton
status: experimental
type: Hunting
description: |
    Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices.
    This detection identifies when a new packaged application has been added, updated or deleted.
data_source:
    - Azure Monitor Activity
search: |
    `azure_monitor_activity` operationName="*MobileApp*"
    | rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
    | rex field="operationName" "^(?P<action>\w+)\s" | replace "Patch" with "updated", "Create" with "created", "Delete", with "deleted", "assign", with "assigned" IN action
    | table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
    | `microsoft_intune_mobile_apps_filter`
how_to_implement: |
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
    Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
references:
    - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
    - https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
    - https://posts.specterops.io/maestro-9ed71d38d546
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1072
    - T1021.007
    - T1202
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: NET Profiler UAC bypass
id: 0252ca80-e30d-11eb-8aa3-acde48001122
version: 11
creation_date: '2021-07-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the registry aimed at bypassing the User Account Control (UAC) feature in Windows. It identifies changes to the .NET COR_PROFILER_PATH registry key, which can be exploited to load a malicious DLL via mmc.exe. This detection leverages data from the Endpoint.Registry datamodel, focusing on specific registry paths and values. Monitoring this activity is crucial as it can indicate an attempt to escalate privileges or persist within the environment. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, compromising system integrity.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: limited false positive. It may trigger by some windows update that will modify this registry.
references:
    - https://offsec.almond.consulting/UAC-bypass-dotnet.html
finding:
    title: Suspicious modification of registry $registry_path$ with possible payload path $registry_path$ and key $registry_key_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '18115.30470'
title: Non-MSIExec .msi Installation
description: 'This use case detects methods used to install .msi files without the
  use of msiexec.exe. Atomics T1218.007 Test #5 Atomics T1218.007 Test #6 Atomics
  T1218.007 Test #7 Atomics T1218.007 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(install) OR TERM(/i)) ".msi" | regex process_name!="(?i)msiexec"
  | table _time, host, user parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md

name: O365 Mail Permissioned Application Consent Granted by User
id: fddad083-cdf5-419d-83c6-baa85e329595
version: 9
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where a user grants consent to an application requesting mail-related permissions within the Office 365 environment. It leverages O365 audit logs, specifically focusing on events related to application permissions and user consent actions. This activity is significant as it can indicate potential security risks, such as data exfiltration or spear phishing, if malicious applications gain access. If confirmed malicious, this could lead to unauthorized data access, email forwarding, or sending malicious emails from the compromised account. Validating the legitimacy of the application and consent context is crucial to prevent data breaches.
data_source:
    - O365 Consent to application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Consent to application.\" ResultStatus=Success | eval admin_consent =mvindex('ModifiedProperties{}.NewValue',0) | search admin_consent=False | eval permissions =mvindex('ModifiedProperties{}.NewValue',4) | rex field=permissions \"Scope:(?<Scope>[^,]+)\" | makemv delim=\" \" Scope | search Scope IN (\"Mail.Read\", \"Mail.ReadBasic\", \"Mail.ReadWrite\", \"Mail.Read.Shared\", \"Mail.ReadWrite.Shared\", \"Mail.Send\", \"Mail.Send.Shared\") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Scope) as Scope by signature dest user src vendor_account vendor_product object ObjectId | `security_content_ctime(lastTime)` | `o365_mail_permissioned_application_consent_granted_by_user_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: OAuth applications that require mail permissions may be legitimate, investigate and filter as needed.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
    - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
    - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
    - https://www.alteredsecurity.com/post/introduction-to-365-stealer
    - https://github.com/AlteredSecurity/365-Stealer
finding:
    title: User $user$ consented an OAuth application that requests mail-related permissions.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1528
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Mailbox Inbox Folder Shared with All Users
id: 21421896-a692-4594-9888-5faeb8a53106
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects instances where the inbox folder of an Office 365 mailbox is shared with all users within the tenant. It leverages Office 365 management activity events to identify when the 'Inbox' folder permissions are modified to include 'Everyone' with read rights. This activity is significant as it represents a potential security risk, allowing unauthorized access to sensitive emails. If confirmed malicious, this could lead to data breaches, exfiltration of confidential information, and further compromise through spear-phishing or other malicious activities based on the accessed email content.
data_source:
    - O365 ModifyFolderPermissions
search: "`o365_management_activity` Operation=ModifyFolderPermissions Workload=Exchange object=Inbox Item.ParentFolder.MemberUpn=Everyone | eval isReadRole=if(match('Item.ParentFolder.MemberRights',\"(ReadAny)\"), \"true\", \"false\") | search isReadRole = \"true\" | rename UserId as user | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime by signature, user, dest, vendor_account, vendor_product, object, MailboxOwnerUPN, Item.ParentFolder.MemberUpn, Item.ParentFolder.MemberRights, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_inbox_folder_shared_with_all_users_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Administrators might temporarily share a mailbox with all users for legitimate reasons, such as troubleshooting, migrations, or other administrative tasks. Some organizations use shared mailboxes for teams or departments where multiple users need access to the same mailbox. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/002/
    - https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
    - https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/
    - https://learn.microsoft.com/en-us/purview/audit-mailboxes
    - https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxodlgt/5610c6e6-3268-44e3-adff-8804f5315946
finding:
    title: Inbox folder for the $MailboxOwnerUPN$ mailbox was shared with all users.
    entity:
        field: MailboxOwnerUPN
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

id: '16743.26616'
title: 'Permission Groups Discovery: Local Groups'
description: 'Adversaries may attempt to find local system groups and permission settings.
  The knowledge of local system permission groups can help adversaries determine which
  groups exist and which users belong to a particular group. Adversaries may use this
  information to determine which users have elevated permissions, such as the users
  found within the local administrators group. Atomics T1069.001 Test #3 Atomics T1069.001
  Test #5 Atomics T1069.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(Get-LocalGroup) OR TERM(Get-LocalGroupMember) OR (("wmic" OR TERM(Get-WMIObject)
  AND TERM(group))) | table _time, host, user, process, process_*, parent_process
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:permission groups discovery
technique_id: 
- T1069
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md#atomic-test-3---permission-groups-discovery-powershell-local

id: '8151.10003'
title: System Time enumeration
description: 'An adversary may gather the system time and/or time zone from a local
  or remote system. The system time is set and stored by the Windows Time Service
  within a domain to maintain time synchronization between systems and services in
  an enterprise network. This use case looks for net time executions. -- Threat Actor
  Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm,
  TA422, STRONTIUM) - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "net" TERM(time) | regex process="(?i)net.*?time.*?\x5c\x5c"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:system time discovery
technique_id: 
- T1124
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/

id: '5454.5612'
title: WebLogic CVE-2017-10271
description: 'A reverse shell is a shell session established on a connection that
  is initiated from a remote machine, not from the local host and in this case the
  session is created using the vulnerability of Weblogic app - wls-wsat Component
  Deserialization - Threat Actor Association: APT29/Nobelium/Cozy Bear -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` TERM(powershell) TERM(-w) TERM(hidden)
  TERM(-nop) TERM(-c) TERM(function) TERM(RSC) AND "system.net.sockets.tcpclient"
  AND "cmd.exe" AND "UseShellExecute" AND EventCode=1 AND "java.exe" | rex field=process
  "\$a\=\''(?<src_ip>(?i)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") | rex field=process
  "\$p\=\''(?<dest_port>(?i)\d{1,5}") | table _time, host, user, process, parent_process_name,
  parent_process_path, src_ip, dest_port, signature_id | bin span=1s | stats values(*)
  as * by _time, host | lookup dnslookup clientip as src OUTPUT clienthost as src_dns
  | iplocation prefix="src_" src| rename src_Country as src_country '
techniques:
- initial-access:exploit public-facing application
- execution:command and scripting interpreter:powershell
technique_id:
- T1190
- T1059.001
data_category:
- Windows Sysmon
references: null

name: Windows Account Discovery for None Disable User Account
id: eddbf5ba-b89e-47ca-995e-2d259804e55e
version: 11
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the PowerView PowerShell cmdlet Get-NetUser with the UACFilter parameter set to NOT_ACCOUNTDISABLE, indicating an attempt to enumerate Active Directory user accounts that are not disabled. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify the specific script block text. Monitoring this activity is significant as it may indicate reconnaissance efforts by an attacker to identify active user accounts for further exploitation. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  ScriptBlockText = "*Get-NetUser*" ScriptBlockText = "*NOT_ACCOUNTDISABLE*" ScriptBlockText = "*-UACFilter*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_account_discovery_for_none_disable_user_account_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
    - https://powersploit.readthedocs.io/en/stable/Recon/README/
    - https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
    - https://atomicredteam.io/discovery/T1087.001/
analytic_story:
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Known Abused DLL Created
id: ea91651a-772a-4b02-ac3d-985b364a5f07
version: 11
creation_date: '2024-03-20'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  `windows_known_abused_dll_created_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives.
references:
    - https://attack.mitre.org/techniques/T1574/002/
    - https://hijacklibs.net/api/
    - https://wietze.github.io/blog/hijacking-dlls-in-windows
    - https://github.com/olafhartong/sysmon-modular/pull/195/files
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The file [$file_name$] was written to an unusual location on [$dest$].
        - field: user
          type: user
          score: 20
          message: The file [$file_name$] was written to an unusual location on [$dest$].
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Windows Defense Evasion Tactics
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Netspy Network Scanner Execution
id: f3ee1ff4-38ab-451e-8dfc-659dea57045f
version: 2
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects usage of the Netspy scanner on an endpoint.
    Netspy is a lightweight, fast, and cross-platform tool designed for internal network segment discovery.
    The tool supports various protocols, including ICMP, ARP, TCP, and UDP, allowing users to scan for active hosts and services within predefined IP ranges.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name="netspy.exe"
    Processes.process IN (
        "*arpspy*",
        "*as*",
        "*icmpspy*",
        "*is*",
        "*pingspy*",
        "*ps*",
        "*tcpspy*",
        "*ts*",
        "*udpspy*",
        "*us*"
    )

    by Processes.process Processes.process_name Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_netspy_network_scanner_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate network administrators may use Netspy for authorized network discovery and maintenance. Filter alerts for approved internal network scanning activities.
references:
    - https://www.securonix.com/blog/from-cobalt-strike-to-mimikatz-slowtempest/
    - https://github.com/shmilylty/netspy
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Potential Netspy Network Scanner activity observed on $dest$ via $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Network Discovery
    - Windows Discovery Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1595
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Proxy Via Netsh
id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf
version: 11
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of netsh.exe to configure a connection proxy, which can be leveraged for persistence by executing a helper DLL. It detects this activity by analyzing process creation events from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "portproxy" and "v4tov4" parameters. This activity is significant because it indicates potential unauthorized network configuration changes, which could be used to maintain persistence or redirect network traffic. If confirmed malicious, this could allow an attacker to maintain covert access or manipulate network communications, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_netsh` Processes.process = "* portproxy *" Processes.process = "* v4tov4 *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_proxy_via_netsh_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process $process_name$ has launched netsh with command-line $process$ on $dest$.
        - field: user
          type: user
          score: 20
          message: A process $process_name$ has launched netsh with command-line $process$ on $dest$.
analytic_story:
    - Volt Typhoon
asset_type: Endpoint
atomic_guid:
    - b8223ea9-4be2-44a6-b50a-9657a3d4e72a
mitre_attack_id:
    - T1090.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows RDPClient Connection Sequence Events
id: 67340df1-3f1d-4470-93c8-9ac7249d11b0
version: 9
creation_date: '2024-11-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: This analytic monitors Windows RDP client connection sequence events (EventCode 1024) from the Microsoft-Windows-TerminalServices-RDPClient/Operational log. These events track when RDP ClientActiveX initiates connection attempts to remote servers. The connection sequence is a critical phase of RDP where the client and server exchange settings and establish common parameters for the session. Monitoring these events can help identify unusual RDP connection patterns, potential lateral movement attempts, unauthorized remote access activity, and RDP connection chains that may indicate compromised systems. NOTE the analytic was written for Multi-Line as XML was not properly parsed out.
data_source:
    - Windows Event Log Microsoft Windows TerminalServices RDPClient 1024
search: |-
    `wineventlog_rdp` EventCode=1024
      | rename host as dest
      | stats count as "Event Count", min(_time) as firstTime, max(_time) as lastTime, values(Message) as messages
        BY dest, source, LogName,
           EventCode, category
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_rdpclient_connection_sequence_events_filter`
how_to_implement: To successfully implement this detection, ensure Windows RDP Client Operational logs are being collected and forwarded to Splunk. Enable logging for "Microsoft-Windows-TerminalServices-RDPClient/Operational", via a new inputs.conf input. See references for more details.
known_false_positives: Legitimate RDP connections from authorized administrators and users will generate these events. To reduce false positives, you should baseline normal RDP connection patterns in your environment, whitelist expected RDP connection chains between known administrative workstations and servers, and track authorized remote support sessions.
references:
    - https://gist.github.com/MHaggis/acd5dcbf1d4fb705b77f0a48e772eefc
    - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Windows RDP client initiated a connection sequence event (EventCode 1024) on host $dest$.
analytic_story:
    - Spearphishing Attachments
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
id: 15603165-147d-4a6e-9778-bd0ff39e668f
version: 12
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies a source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. It leverages EventCode 4776 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access or privilege escalation, posing a significant threat to the Active Directory environment. This detection is focused on domain controllers.
data_source:
    - Windows Event Log Security 4776
search: |-
    `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
      | bucket span=2m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
        BY _time, Workstation
      | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
        BY Workstation
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
      | search isOutlier=1
      | rename Workstation as src
      | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Potential NTLM based password spraying attack from $src$
        - field: src
          type: system
          score: 20
          message: Potential NTLM based password spraying attack from $src$
analytic_story:
    - Active Directory Password Spraying
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint