Splunk rules: 2r

name: Azure AD PIM Role Assigned
id: fcd6dfeb-191c-46a0-a29c-c306382145ab
version: 14
creation_date: '2023-04-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user is added as an eligible member to a PIM role. This activity is significant because PIM roles grant elevated privileges, and their assignment should be closely monitored to prevent unauthorized access. If confirmed malicious, an attacker could exploit this to gain privileged access, potentially leading to unauthorized actions, data breaches, or further compromise of the environment.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` operationName="Add eligible member to role in PIM completed*"
      | rename properties.* as *
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src_user
           vendor_account vendor_product signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_pim_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: As part of legitimate administrative behavior, users may be assigned PIM roles. Filter as needed
references:
    - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
    - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
finding:
    title: An Azure AD PIM role assignment was assiged to $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Azure Active Directory Persistence
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '1036.1047'
title: Command-Line Interface Execution
description: 'Detects when a Command-Line Interface executes on a host. -- Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT31, APT35/Phosphorus/Magic Hound,
  APT36, APT37, APT41, Carbanak, FamousSparrow, FIN6, FIN7, FIN8, Kimsuky, MalKamak,
  MuddyWater, Night Spider, TA,505, TA551, Prophet Spider, Wizard Spider, WIRTE --
  Software Association: Astaroth, BadHatch, Bazar, Conti, Cring, Emotet, GhostShell,
  Hafnium, Hancitor, Harvester, Hive, IcedID, MINEBRIDGE, MirrorBlast, MysterySnail,
  Nefilim, PowerShortShell, Prometheus / Spook, QakBot, Ransom Cartel, RATDispenser,
  Remcos, Ryuk, Sodinokibi/REvil, SquirrelWaffle, Trickbot, XingLocker, Zloader, Zumkong'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) AND ("powershell.exe" OR "cmd.exe") | table _time,
  host, user event_id, parent_*, process_*, process, signature_id | bin span=60s |
  stats values(*) as * by _time, host | where match(process_path,"(?i)powershell\.exe")
  OR match(process_path,"(i?)cmd\.exe") '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- Windows event logs
references:
- https://securityintelligence.com/an-increase-in-powershell-attacks-observations-from-ibm-x-force-iris/
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/tracking-detecting-and-thwarting-powershell-based-malware-and-attacks

name: Detect New Local Admin account
id: b25f6f62-0712-43c1-b203-083231ffd97d
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode 4732 (user added to Administrators group). This activity is significant as it indicates potential unauthorized privilege escalation, which is critical for SOC monitoring. If confirmed malicious, this could allow attackers to gain administrative access, leading to unauthorized data access, system modifications, and disruption of services. Immediate investigation is required to mitigate risks and prevent further unauthorized actions.
data_source:
    - Windows Event Log Security 4732
    - Windows Event Log Security 4720
search: |
    `wineventlog_security`
    (
      EventCode=4720
      OR
      (
        EventCode=4732
        AND
        (
          Group_Name=Administrators
          OR
          TargetUserName=Administrators
        )
      )
    )
    | transaction user dest connected=false maxspan=180m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  dc(EventCode) as distinct_eventcodes
      by src_user user dest
    | where distinct_eventcodes > 1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_new_local_admin_account_filter`
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732
known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives
references: []
finding:
    title: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
analytic_story:
    - DHS Report TA18-074A
    - HAFNIUM Group
    - CISA AA22-257A
    - CISA AA24-241A
    - Scattered Lapsus$ Hunters
asset_type: Windows
mitre_attack_id:
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

name: ESXi VIB Acceptance Level Tampering
id: d051d94f-c792-445e-b5d2-0b904f93ac09
version: 6
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies changes to the VIB (vSphere Installation Bundle) acceptance level on an ESXi host. Modifying the acceptance level, such as setting it to CommunitySupported, lowers the system's integrity enforcement and may allow the installation of unsigned or unverified software.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*esxcli software acceptance set*" Message="*shell*" | rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vib_acceptance_level_tampering_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Administrators may use this command when installing third party VIBs. Tune as needed.
finding:
    title: VIB Acceptance level was modified on ESXi host $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: VIB Acceptance level was modified on ESXi host $dest$ by $user$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
    - China-Nexus Threat Activity
asset_type: Infrastructure
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '7833.10327'
title: Finger Execution
description: 'Finger.exe, a command that ships with Windows to retrieve information
  about users on remote computers running the Finger service or daemon. Communication
  is carried via the Name/Finger network communication protocol.As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Software Association:
  MINEBRIDGE -- Atomics T1105 Test #16 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ("finger.exe" OR
  (".exe" "@"))| table _time, host, user process, process_*, signature_id, parent_*
  | bin span=1s | stats values(*) as * by _time, host | where match(process_name,"(?i)finger")
  OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://dmfrsecurity.com/2020/12/31/using-finger-exe-to-transfer-files/
- https://strontic.github.io/xcyclopedia/library/finger.exe-8E9AFA491D704EAF9183B15A189BBDE2.html

name: HTTP Duplicated Header
id: 1606cc5b-fd5f-4865-9fe3-0ed1eaec2df6
version: 5
creation_date: '2025-10-21'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: Detects when a request has more than one of the same header. This is commonly used in request smuggling and other web based attacks. HTTP Request Smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP requests by using ambiguous or malformed headers to hide malicious requests within legitimate ones. Attackers leverage duplicate headers, particularly Content-Length and Transfer-Encoding, to cause different servers in the chain to disagree on where one request ends and another begins. RFC7230 states that a sender MUST NOT generate multiple header fields with the same field name in a message unless either the entire field value for that header field is defined as a comma-separated list or the header field is a well-known exception.
data_source:
    - Suricata
search: |-
    `suricata` http.request_headers{}.name="*"
      | rename dest_ip as dest
      | spath path=http.request_headers{}.name output=header_names
      | mvexpand header_names
      | where lower(header_names) != "set-cookie"
      | stats count
        BY _raw, header_names, src_ip,
           dest
      | where count > 1
      | stats values(header_names) as duplicate_headers
        BY _raw, count, src_ip,
           dest
      | `http_duplicated_header_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. Some of these will need to have all headers dumped to contain the necessary fields.
known_false_positives: False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources.
references:
    - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
    - https://portswigger.net/research/http1-must-die
    - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
    - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Duplicated headers within a web request was detected. The source IP is $src_ip$ and the destination is $dest$.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - HTTP Request Smuggling
asset_type: Network
mitre_attack_id:
    - T1071.001
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '10325.24411'
title: Network Share Connection Removal
description: 'Adversaries may remove share connections that are no longer useful in
  order to clean up traces of their operation. Atomics T1070.005 Test #2 Atomics T1070.005
  Test #3 Atomics T1070.005 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(Remove-SmbShare)
  OR TERM(Remove-Fileshare) | table _time, host, user process, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indicator removal:network share connection removal
technique_id:
- T1070.005
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.005/T1070.005.md#atomic-test-3---remove-network-share-powershell

id: '5858.6156'
title: Rename System Utilities
description: 'Adversaries may rename legitimate system utilities to try to evade security
  mechanisms concerning the usage of those utilities. - Threat Actor Association:
  APT29/Nobelium/Cozy Bear, FIN6, FIN6, Lockean, TA551 - Software Association: IcedID,
  Nokoyawa'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") TERM(Execute/Traverse) | rename Object_Name as object_name | table
  _time, host, user process, process_*, signature_id, parent_*, object_name | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036.003
data_category:
- Windows event logs
references:
- https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html

id: '5453.5608'
title: SSH Brute Force detection
description: 'Detect possible brute force attempts using SSH in Unix. - Threat Actor
  Association: 8220 Gang, Daixin Team, Lancefly, Sandworm (UAC-0165)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` TERM(ssh) TERM(res=failed) TERM(type=USER_AUTH)
  | rex field=_raw "[^\w]"(?<process_name>"(ssh)")"[^\w]"| eval src_ip=mvfilter( NOT
  match(addr,"\?")), user=mvappend("",acct,user,auid,uid), user=mvfilter(NOT match(user,"\?|\(unknown\)|\d+|unset|^\s$|^$")),
  user_id=mvappend("",auid,uid), user_id=mvfilter(match(user_id,"\d+")) | table _time,
  host, user process, process_*, res, src_ip, user_id | bin _time span=10sec | eventstats
  count by host, _time, res | stats values(*) as * by host, _time, res | where count
  > 3 | bin _time span=10min | stats values(*) as * list(count) as count_list sum(count)
  as count_span by host, _time, res | where mvcount(count_list) > 1 OR count_span
  > 20 | rename count_span as count| lookup dnslookup clientip as src_ip OUTPUT clienthost
  as src_dns | iplocation prefix="src_" src_ip | rename src_Country as src_country '
techniques:
- credential-access:brute force:password guessing
- credential-access:brute force:password spraying
technique_id:
- T1110.001
- T1110.003
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://linuxhint.com/bruteforce_ssh_ftp/

name: Windows Executable Masquerading as Benign File Types
id: 0470c8e7-dd8d-420f-8302-073e8a2b66f0
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the presence of executable files masquerading as benign file types on Windows systems. Adversaries employ this technique to evade defenses and trick users into executing malicious code by renaming executables with extensions commonly associated with documents, images, or other non-executable formats (e.g., .pdf, .jpg, .doc, .png).
data_source:
    - Sysmon EventID 29
search: |
    `sysmon`
    EventCode=29
    NOT `executable_extensions`
    | stats count min(_time) as firstTime max(_time) as lastTime
      by Image file_name file_path process_guid file_hash process_id dest user EventCode
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_executable_masquerading_as_benign_file_types_filter`
how_to_implement: |
    To implement Sysmon EventCode 29 (File Block Executable), you must ensure that your Sysmon deployment is configured to log instances where executable file creation is blocked based on your organization's FileBlockExecutable rules. Once enabled, the corresponding Splunk search requires Sysmon operational logs and an input macro named sysmon, which should be customized to match your environment-specific index, source, and sourcetype settings for Windows Sysmon data. We strongly recommend replacing this macro with values appropriate to your Splunk environment so the search scopes correctly. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: |
    File types that are not included in the filter for this detection may generate false positives, so proper filtering is required.
references:
    - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity-7394805779448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
    - https://www.blackhillsinfosec.com/a-sysmon-event-id-breakdown/
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://www.esentire.com/blog/evalusion-campaign-delivers-amatera-stealer-and-netsupport-rat
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A valid Windows PE executable $file_name$ located in $file_path$ was dropped on $dest$, disguised as a non-executable file type.
threat_objects:
    - field: Image
      type: process
    - field: file_name
      type: file_name
    - field: file_path
      type: file_path
analytic_story:
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1036.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows PowerShell Add Module to Global Assembly Cache
id: 3fc16961-97e5-4a5b-a079-e4ab0d9763eb
version: 12
creation_date: '2023-01-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a DLL to the Windows Global Assembly Cache (GAC) using PowerShell. It leverages PowerShell Script Block Logging to identify commands containing "system.enterpriseservices.internal.publish". This activity is significant because adding a DLL to the GAC allows it to be shared across multiple applications, potentially enabling an adversary to execute malicious code system-wide. If confirmed malicious, this could lead to widespread code execution, privilege escalation, and persistent access across the operating system, posing a severe security risk.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText IN("*system.enterpriseservices.internal.publish*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powershell_add_module_to_global_assembly_cache_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives may be present based on developers or third party utilities adding items to the GAC.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
    - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
finding:
    title: PowerShell was used to install a module to the Global Assembly Cache on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - IIS Components
asset_type: Endpoint
mitre_attack_id:
    - T1505.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint