Splunk rules: 2q

name: Azure AD PIM Role Assignment Activated
id: 952e80d0-e343-439b-83f4-808c3e6fbf2e
version: 15
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the activation of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user activates a PIM role assignment, indicated by the "Add member to role completed (PIM activation)" operation. Monitoring this activity is crucial as PIM roles grant elevated privileges, and unauthorized activation could indicate an adversary attempting to gain privileged access. If confirmed malicious, this could lead to unauthorized administrative actions, data breaches, or further compromise of the Azure environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` operationName="Add member to role completed (PIM activation)"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_pim_role_assignment_activated_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: As part of legitimate administrative behavior, users may activate PIM roles. Filter as needed
references:
    - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
    - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
finding:
    title: An Azure AD PIM role assignment was activated by $initiatedBy$ by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Azure Active Directory Persistence
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '33834.59906'
title: DLL Concatenation
description: 'Threat actors were observed using Impacket to concatenate the malicious
  proxy tool Stowaway (msoe.dll) with all DLLs starting with ''d'' from the system32
  directory into a single DLL (appmgmt.dll) to pad and obfuscate the malicious DLL,
  thereby facilitating its deployment and evasion. This use case detects copy commands
  followed by either *.dll or multiple .dll references, indicating possible attempts
  to concatenate multiple DLLs into a single file. NOTE: For commands using ''copy''
  or ''type'', they must be executed in a way that creates a new process, e.g. with
  cmd /c or powershell -c, as they are built-in commands that run within the current
  cmd session and do not create new processes on their own.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(copy) OR TERM(robocopy) OR TERM(xcopy) OR ((TERM(type) OR TERM(Get-Content)
  OR "gc" OR "cat" OR TERM(more)) ">")) ".dll" | regex process="(?i)(copy|more|Get-Content|type|cat|gc)\s+.*?((\/b\s+\S+\.dll\s+\+\s*\S+\.dll)|(\*\.dll\s+\S+)|(\.dll.*\.dll))"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:obfuscated files or information:binary padding
technique_id:
- T1036
- T1027.001
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1027/001/
- https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive/

id: '33360.59027'
title: Domain Controller Enumeration via nltest
description: Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. Functionality could exist within remote access
  tools to enable this, but utilities available on the operating system could also
  be used such as Nltest. Adversaries may look for details about the network configuration
  and settings, such as IP and/or MAC addresses, of systems they access or through
  information discovery of remote systems. Several operating system administration
  utilities exist that can be used to gather this information. Examples include Arp,
  ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with
  options dclist or dsgetdc.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(nltest) (TERM(dclist)
  OR TERM(dsgetdc)) | table _time, host, user, process, process_*, parent_* | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id: 
- T1016
- T1018
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest

name: GetWmiObject Ds Computer with PowerShell
id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
version: 9
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter.
    This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
    This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain computers and gather situational awareness within Active Directory.
    If confirmed malicious, this behavior could allow attackers to map the network, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        `process_powershell`
        OR
        `process_cmd`
    )
    AND
    Processes.process = "*Get-WmiObject*"
    Processes.process = "*namespace *"
    Processes.process = "*root\\directory\\ldap*"
    Processes.process = "*class *"
    Processes.process = "* ds_computer*"

    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getwmiobject_ds_computer_with_powershell_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Remote system discovery enumeration using WMI via the command $process$ on $dest$ by $user$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: command
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '26208.48343'
title: Internal Port Scan - Critical Ports
description: 'After gaining an initial foothold, threat actors may attempt to identify
  services operating on hosts within the network, often using legitimate port scanning
  software. This use case detects when more than 5 of the following ports have been
  scanned from a single internal source IP within one minute: 21 (FTP), 22 (SSH),
  23 (Telnet), 25 (SMTP), 80 (HTTP), 8080 (Alternative HTTP), 139 (NetBIOS/SMB), 389
  (LDAP), 443 (HTTPS), 8443 (Alternative HTTPS), 445 (Microsoft-DS/SMB), 3306 (MySQL),
  3389 (RDP). '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5152) OR
  "<EventID>5152<" OR TERM(EventCode=5156) OR "<EventID>5156<") | where match(src_ip,
  "(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})")
  and match(dest_port, "^(21|22|23|25|80|8080|139|389|443|8443|445|3306|3389)$") and
  not match(process_path, "(?i)\x5csplunkuniversalforwarder\x5cbin\x5csplunkd\.exe")
  | table _time, host, user, signature_id, process, process_*, dest_port, dest_ip,
  src_ip | bin span=60s | stats values(*) as * by _time, host | streamstats dc(dest_port)
  as dc_dest_port by _time, src_ip| where dc_dest_port>5 '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows event logs
references:
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf?utm_source=blog&utm_medium=blog&utm_campaign=rhysida-ransomware
- https://www.advanced-port-scanner.com/

id: '20231.35920'
title: ISO Image Mounted - Windows
description: 'Threat actors such as APT29 have used ISO files to deliver malicious
  code to target systems. Normally, when a file is downloaded from the internet, Windows
  adds a Zone Identifier to identify the file''s origin (known as mark-of-the-web
  or MOTW). Files stored with an ISO do not contain the Zone Identifier Alternate
  Data Stream, enabling MOTW bypass. This use case detects ISO images mounted on Windows
  systems. -- Threat Actor Association: Lazarus -- Atomics T1553.005 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") "Device\\CdRom" | where match(file_path, "(?i)\x5cDevice\x5cCdRom")
  and not match(file_path, "\x5cDevice\x5cCdRom0\x5csetup\.exe")| table _time, host,
  user, process, process_*, parent_process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:subvert trust controls:mark-of-the-web bypass
- execution:user execution:malicious file
technique_id:
- T1553.005
- T1204.002
data_category:
- Windows event logs
references:
- https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
- https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image

name: Linux Auditd Auditd Service Stop
id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
data_source:
    - Linux Auditd Service Stop
search: |-
    `linux_auditd` type=SERVICE_STOP unit IN ("auditd")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type pid comm
           exe unit dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_auditd_service_stop_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A service event - [$type$] event occurred on host - [$dest$].
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Change File Owner To Root
id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
version: 11
creation_date: '2022-01-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd` proctitle = "*chown *root*"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_change_file_owner_to_root_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
    - https://askubuntu.com/questions/617850/changing-from-user-to-superuser
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to change a file owner to root.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1222.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux SSH Remote Services Script Execute
id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
version: 14
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of SSH to move laterally and execute a script or file on a remote host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific SSH command-line parameters and URLs. This activity is significant as it may indicate an attacker attempting to execute remote commands or scripts, potentially leading to unauthorized access or control over additional systems. If confirmed malicious, this could result in lateral movement, privilege escalation, or the execution of malicious payloads, compromising the security of the network.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*")
        AND
        Processes.process IN ("*http:*","*https:*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ssh_remote_services_script_execute_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This is not a common command to be executed. Filter as needed.
references:
    - https://redcanary.com/blog/lateral-movement-with-secure-shell/
finding:
    title: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally and download a file.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally and download a file.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
    - Hellcat Ransomware
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 New Email Forwarding Rule Created
id: 68469fd0-1315-44ba-b7e4-e92847bb76d6
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
data_source: []
search: "`o365_management_activity` (Operation=New-InboxRule OR Operation=set-InboxRule) | eval match1=mvfind('Parameters{}.Name', \"ForwardTo\") | eval match2=mvfind('Parameters{}.Name', \"ForwardAsAttachmentTo\") | eval match3=mvfind('Parameters{}.Name', \"RedirectTo\") | where match1>= 0 OR match2>= 0 OR match3>= 0 | eval ForwardTo=coalesce(ForwardTo, ForwardAsAttachmentTo, RedirectTo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime values(Name) as Name by signature dest user src vendor_account vendor_product ForwardTo | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_email_forwarding_rule_created_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Users may create email forwarding rules for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/003/
finding:
    title: A forwarding email inbox rule was created for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

id: '19686.34350'
title: Office Spawns Suspicious Child Process
description: 'This use case attempts to identify suspicious child processes spawned
  from a Microsoft Office application -- Threat Actor Association: RomCom (Storm-0978)
  -- Vulnerability Association: CVE-2023-36884'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (powershell.exe OR pwsh.exe OR cmd.exe OR mshta.exe
  OR wscript.exe OR cscript.exe OR regsvr32.exe OR rundll32.exe OR taskkill.exe OR
  csc.exe OR calc.exe OR control.exe) ((Microsoft OR Office) OR WINWORD.EXE OR EXCEL.EXE
  OR POWERPNT.EXE OR MSACCESS.EXE OR OUTLOOK.EXE OR VISIO.EXE OR WINPROJ.EXE OR ONENOTE.EXE
  OR GRAPH.EXE OR MSPub.EXE OR wordpad.exe) | regex process_name="(?i)(powershell|pwsh|cmd|mshta|wscript|cscript|regsvr32|rundll32|taskkill|csc|calc|control)\.exe"|
  regex parent_process_path="(?i)Microsoft\sOffice|winword|excel|powerpnt|msaccess|outlook|visio|winproj|onenote|graph|mspub|wordpad"
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host, parent_process_name | where match(parent_process_path,"(?i)(Microsoft
  Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(ONENOTE\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(GRAPH\.exe)|(MSPub\.exe)|(WINPROJ.EXE\.exe)|(wordpad\.exe)") '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://fourcore.io/blogs/cve-2023-36884-ms-office-zero-day-vulnerability

name: Okta Multiple Users Failing To Authenticate From Ip
id: de365ffa-42f5-46b5-b43f-fa72290b8218
version: 11
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies instances where more than 10 unique user accounts have failed to authenticate from a single IP address within a 5-minute window in an Okta tenant. This detection uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud. Such activity is significant as it may indicate brute-force attacks or password spraying attempts. If confirmed malicious, this behavior suggests an external entity is attempting to compromise multiple user accounts, potentially leading to unauthorized access to organizational resources and data breaches.
data_source:
    - Okta
search: |-
    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime dc(Authentication.user) as unique_accounts values(Authentication.signature) as signature values(Authentication.user) as user values(Authentication.app) as app values(Authentication.authentication_method) as authentication_method values(Authentication.dest) as dest FROM datamodel=Authentication
      WHERE Authentication.action="failure"
        AND
        Authentication.signature=user.session.start
      BY _time span=5m Authentication.src
         sourcetype
    | where unique_accounts > 9
    | `drop_dm_object_name("Authentication")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `okta_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: A source Ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://splunkbase.splunk.com/app/6553
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Multiple users failing to authenticate from a single source IP Address - [$src$]. Investigate further to determine if this was authorized.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

id: '16633.25780'
title: 'Permission Groups Discovery: Domain Groups'
description: 'Adversaries may attempt to find domain-level groups and permission settings.
  The knowledge of domain-level permission groups can help adversaries determine which
  groups exist and which users belong to a particular group. Adversaries may use this
  information to determine which users have elevated permissions, such as domain administrators.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta) - Software Association: Akira, Rhysida -- Atomics T1069.001
  Test #2 Atomics T1069.002 Test #1 Atomics T1069.002 Test #2 Atomics T1069.002 Test
  #3 Atomics T1069.002 Test #9 Atomics T1069.002 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(Get-LocalGroup) OR TERM(Get-LocalGroupMember) OR (("wmic" OR TERM(Get-WMIObject)
  AND TERM(group))) | regex process="(?i)\s+(localgroup|group(s?)\s+.*doma)|Get-AD(PrincipalGroupMembership|Group)|objectcategory=group"
  | table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:permission groups discovery:domain groups
- discovery:permission groups discovery
technique_id:
- T1069.002
- T1069
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-1---basic-permission-groups-discovery-windows-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-2---permission-groups-discovery-powershell-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-3---elevated-group-enumeration-using-net-group-domain

id: '22480.40157'
title: Potential Follina_DogWalk Activity - mdst.exe
description: CVE-2022-30190 (commonly referred to as Follina) and DogWalk involve
  a vulnerability in Microsoft Support Diagnostic Tool (msdt.exe). During exploitation,
  msdt.exe is observed loading the library file sdiageng.dll which can be abused by
  threat actors to download arbitrary code. This use case detects module loads of
  sdiageng.dll by msdt.exe. Sysmon event 7 is required for detection. LOLBINS\LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=7) OR "<EventID>7<")
  Image="*\\msdt.exe" ImageLoaded="*\\sdiageng.dll" | table _time, host, user host,
  process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:exploitation for client execution
technique_id: 
- T1203
data_category:
- Windows Sysmon
references:
- https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/

name: Python PYTHONPATH Modification During Package Installation
id: 00f01ba4-df01-4caa-90f6-187e4563a516
version: 1
creation_date: '2026-08-21'
modification_date: '2026-08-21'
author: Onur Mustafa Erdogan, Splunk
status: production
type: TTP
description: |-
    The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
    Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
    If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
    If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 13
search: |-
    `sysmon`
    EventID IN (1,13)
    (
        parent_process="*\\site-packages\\pip\\*"
        OR
        (
            registry_path="*PYTHONPATH"
            action="modified"
        )
    )

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(parent_process_id) as parent_process_id
                  values(parent_process_name) as parent_process_name
                  values(parent_process_path) as parent_process_path
                  values(parent_process) as parent_process
                  values(process_path) as process_path
                  values(process_name) as process_name
                  values(process) as process
                  values(registry_path) as registry_path
                  values(registry_value_data) as registry_value_data
                  dc(EventID) as dc_event_id

      by dest source process_id

    | search dc_event_id>1

    | table firstTime lastTime
            parent_process_id parent_process_path parent_process_name parent_process
            process_id process_path process_name process
            registry_path registry_value_data
            dest source

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `python_pythonpath_modification_during_package_installation_filter`
how_to_implement: |-
    This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1)
    and registry modification (EventID 13) events, ensuring that registry modification events are collected for the
    PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on
    and normalize field names using the Splunk Common Information Model (CIM).
known_false_positives: |-
    Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration.
    Investigate the new value and parent process to determine legitimacy.
references:
    - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
finding:
    title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$].
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process
      type: process
    - field: registry_value_data
      type: registry_value_data
analytic_story:
    - Malicious Python Package Installation
    - Compromised Windows Host
    - Windows Persistence Techniques
    - Suspicious Windows Registry Activities
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1574.007
    - T1195.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Rundll32 LockWorkStation
id: fa90f372-f91d-11eb-816c-acde48001122
version: 13
creation_date: '2021-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the rundll32.exe command with the user32.dll,LockWorkStation parameter, which is used to lock the workstation via command line. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is an uncommon method to lock a screen and has been observed in CONTI ransomware tooling for defense evasion. If confirmed malicious, this technique could indicate an attempt to evade detection and hinder incident response efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `rundll32_lockworkstation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://threadreaderapp.com/thread/1423361119926816776.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Process $process_name$ with cmdline $process$ in host $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6561.7484'
title: SAM, System, Security Files Accessed
description: 'This use case looks for file access of C:\Windows\System32\config\(SAM|System|Security)
  as seen with HiveNightmare/SeriousSam CVE-2021-33757. Vulnerability that allows
  non-admins to access the Security Account Manager (SAM) database, which stores users’
  passwords. - Threat Actor Association: Flax Typhoon, Lapsus$ -- Software Association:
  Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") TERM("C:\\Windows\\System32\\config\\*") (TERM(SAM) OR TERM(SYSTEM)
  OR TERM(security))| regex Object_Name="(?i)(sam|system|security)$" | eval file_path=Object_Name|
  fields _time, host, user, signature_id, process, process_*, parent_*, signature,
  file_path, parameters `group_events("host", 1)` '
techniques:
- credential-access:os credential dumping:security account manager
technique_id:
- T1003.002
data_category:
- Windows event logs
- File monitoring
references:
- https://www.blumira.com/sam-database-vulnerability/

id: '25326.47153'
title: Scheduled Task with Potential SSH Tunnel - Windows
description: Threat actors have been observed using scheduled tasks to create reverse
  SSH tunnels to facilitate persistence on a compromised machine as reported by DFIR.
  This use case detects scheduled tasks created with commands indicating potential
  SSH tunnels. The regex filtering matches on the patterns <user>@<IP address> and
  <port number>:<IP Address> :<port number>. Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "@" "/create" ("-L"
  OR "-R" OR "-N" OR "-D" OR "-C" OR "IdentitiesOnly=yes" OR "StrictHostKeyChecking=no"
  OR "ssh") | where match(process, "\w+@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}") and match(process,
  "\d{1,5}:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5}") and match(process, "(?i)\-(L|R|N|D|C)|IdentitiesOnly=yes|StrictHostKeyChecking=no|ssh")
  | table _time, host, user, process, process_*, parent_process_name, parent_process_*,
  signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:scheduled task/job
- command-and-control:protocol tunneling
technique_id: 
- T1053
- T1572
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '19911.35072'
title: Startup Folder Location Modified - Windows
description: 'Adversaries may achieve persistence by adding a program to a startup
  folder or referencing it with a Registry run key. Adding an entry to the "run keys"
  in the Registry or startup folder will cause the program referenced to be executed
  when a user logs in. Adversaries may modify registry values to point to a new startup
  folder where a payload could be stored to launch at boot. This use case detects
  modifications to registry values that can be used to change the startup folder location.
  Atomics T1546.002 Test #10 Atomics T1546.002 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(reg) TERM(add) "Startup" "Windows\\CurrentVersion\\Explorer\\User
  Shell Folders" | table _time, host, user, parent_process*, process, process_*, signature_id,
  user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
technique_id:
- T1547.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-10---change-startup-folder---hklm-modify-user-shell-folders-common-startup-value
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md#atomic-test-11---change-startup-folder---hkcu-modify-user-shell-folders-startup-value

id: '24143.44553'
title: Suspicious Parent Process for msiexec.exe
description: msiexec.exe is a Windows system component used to install and modify
  software packages using Windows Installer. Threat actors may abuse msiexec.exe to
  install malicious software or execute scripts, leveraging its legitimate appearance
  to bypass security measures and gain persistence on a targeted system as observed
  in FlawedGrace attacks. This use case detects executions of msiexec.exe with suspicious
  parent processes. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(msiexec) OR "msiexec.exe" | regex parent_process_name="(?i)(spoolsv|powershell|pwsh|cmd|svchost|winlogon|taskhost|wininit)\.exe"
  | table _time, host, user process, process_*, parent_process_name, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

name: Windows AD Abnormal Object Access Activity
id: 71b289db-5f2c-4c43-8256-8bf26ae7324a
version: 10
creation_date: '2023-08-18'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic identifies a statistically significant increase in access to Active Directory objects, which may indicate attacker enumeration. It leverages Windows Security Event Code 4662 to monitor and analyze access patterns, comparing them against historical averages to detect anomalies. This activity is significant for a SOC because abnormal access to AD objects can be an early indicator of reconnaissance efforts by an attacker. If confirmed malicious, this behavior could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
data_source:
    - Windows Event Log Security 4662
search: |-
    `wineventlog_security` EventCode=4662
      | stats min(_time) AS firstTime, max(_time) AS lastTime, dc(ObjectName) AS ObjectName_count, values(ObjectType) AS ObjectType, latest(Computer) AS dest count
        BY SubjectUserName
      | eventstats avg(ObjectName_count) AS average stdev(ObjectName_count) AS standarddev
      | eval limit = round((average+(standarddev*3)),0), user = SubjectUserName
      | where ObjectName_count > limit
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_ad_abnormal_object_access_activity_filter`
how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662. The required SACLs need to be created for the relevant objects. Be aware Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires.
known_false_positives: Service accounts or applications that routinely query Active Directory for information.
references:
    - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
    - https://attack.mitre.org/tactics/TA0007/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The account $user$ accessed an abnormal amount ($ObjectName_count$) of [$ObjectType$] AD object(s) between $firstTime$ and $lastTime$.
analytic_story:
    - Active Directory Discovery
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD AdminSDHolder ACL Modified
id: 00d877c3-7b7b-443d-9562-6b231e2abab9
version: 11
creation_date: '2022-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Dean Luxton, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.
data_source:
    - Windows Event Log Security 5136
search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*"  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`'
how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications.
known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed
references:
    - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
    - https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx
    - https://adsecurity.org/?p=1906
    - https://pentestlab.blog/2022/01/04/domain-persistence-adminsdholder/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists
    - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
finding:
    title: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1546
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint