Splunk rules: 2s

id: '44220.86863'
title: Browser Started with Remote Debugging - Windows
description: Threat actors may abuse browser remote debugging features to extract
  sensitive data, maintain access, or facilitate communication with C2 servers. This
  is typically done by launching the browser with specific remote debugging flags,
  allowing remote access to browser sessions and potentially bypassing traditional
  security controls. This use case detects instances where a browser is started in
  remote debugging mode.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103)
  OR "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Firefox)
  " -start-debugger-service") OR " --remote-debugging-" | where match(process, "(?i)\s+--remote-debugging-\S+")
  or match(process, "(?i)firefox.+\s+-start-debugger-service") | table _time, host,
  user, process, parent_process_name, process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- collection:browser session hijacking
technique_id: 
- T1185
data_category:
- PowerShell logs
references:
- https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
- https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
- https://github.com/defaultnamehere/cookie_crimes/
- https://github.com/wunderwuzzi23/firefox-cookiemonster
- https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html
- https://cyble.com/blog/fake-coding-challenges-steal-sensitive-data-via-fogdoor/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_browsers_remote_debugging/

name: Cisco Duo Policy Skip 2FA for Other Countries
id: ab59d5ee-8694-4832-a332-cefcf66a9057
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |
    The following analytic detects when a Duo policy is created or updated to allow access without two-factor authentication (2FA)
    for users in countries other than the default. It identifies this behavior by searching Duo administrator activity logs for policy
    creation or update actions where the policy description indicates that access is permitted without 2FA for certain user locations.
    This is achieved by parsing the relevant fields in the logs and filtering for the specific condition of 'Allow access without 2FA.'
    This behavior is significant for a Security Operations Center (SOC) because bypassing 2FA for any user group or location weakens
    the organization's security posture and increases the risk of unauthorized access. Attackers or malicious insiders may exploit
    such policy changes to circumvent strong authentication controls, potentially leading to account compromise, data breaches, or
    lateral movement within the environment. Early detection of these policy modifications enables the SOC to investigate and respond
    before attackers can leverage the weakened controls, thereby reducing the risk and impact of a successful attack.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=policy_update OR action=policy_create
      | spath input=description
      | search user_locations_default_action="Allow access without 2FA"
      | rename object as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action actionlabel description
           user admin_email
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_policy_skip_2fa_for_other_countries_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A policy has been created or updated to allow access without 2FA for other countries by user $user$ with email $admin_email$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

id: '1141.1221'
title: Clear Linux System Logs
description: 'This use case would detect the alteration or removal of log files. Atomics
  T1070.003 Test #3 Atomics T1070.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve
  OR sourcetype=bash_history) AND ((TERM(vi) OR TERM(vim) OR TERM(nano) OR (TERM(echo)
  AND TERM(>)) OR TERM(visudo) OR TERM(rm) OR (TERM(dd) AND TERM(if)) OR (TERM(cat)
  AND "/dev/null") OR (TERM(truncate) AND TERM(0)) OR (TERM(tee) AND NOT TERM(-a))
  OR TERM(shred) OR TERM(wipe)) AND ("auth.log" OR TERM(faillog) OR TERM(secure) OR
  TERM(syslog) OR TERM(messages) OR TERM(utmp) OR TERM(wtmp) OR "kern.log" OR "audit.log"
  OR "cron.log" OR "error.log" OR "access.log" OR "boot.log" OR "mysqld.log" OR TERM(httpd)
  OR "yum.log")) OR TERM(covermyass) | rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")|
  eval process=mvappend(process, proc) | regex process!="(?i)(\/)?(etc|home|opt|bin|sbin|dev|ext|lib|media|mnt|proc|root|sys|tmp|usr|boot)\/\w+"
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host | where match(process, "(?i)(vi|vim|nano|echo.*\>|visudo|rm|shred|wipe)\s")
  OR match(process, "(?i)dd\s.*if[^a-z0-9]") OR match(process, "(?i)truncate\s") OR
  (match(process, "(?i)tee") and not match(process, "(?i)tee\s.*-a")) '
techniques:
- defense-evasion:indicator removal:file deletion
- defense-evasion:indicator removal:clear linux or mac system logs
- defense-evasion:indicator removal:clear command history
technique_id:
- T1070.003
- T1070.002
- T1070.004
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://null-byte.wonderhowto.com/how-to/clear-logs-history-linux-systems-cover-your-tracks-remain-undetected-0244768/
- https://hackingpassion.com/clear-your-tracks-on-linux/
- https://null-byte.wonderhowto.com/forum/easily-cover-your-tracks-from-kali-linux-after-hacking-system-0205468/

id: '1043.1068'
title: Command and Control Detection
description: 'Detects malicious (like Github repositories or known suspicious IPs)
  sources based on a list of IPs and domains. - Threat Actor Association: APT29/Nobelium/Cozy
  Bear, Magic Hound (APT32, Phosphorus, Mint Sandstorm), UNC4990 - Software Association:
  Alchimist, Remcos RAT'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=3 `fltr_bl_ip_address`
  | table _time, host, user dest, dest_ip, dest_port, direction, dvc, dvc_nt_host,
  event_id, eventtype, host, index, parent_process_id, process_id, process_name, process_path,
  signature_id, source, sourcetype, src, src_ip, src_port, tag, transport, user, user_id|
  bin span=60s | stats values(*) as * by _time, host `add_enrichment_rule("AVL_R1068")`
  `hec_collect`'
techniques:
- command-and-control:application layer protocol:web protocols
- command-and-control:non-application layer protocol
technique_id:
- T1071.001
- T1095
data_category:
- Windows Sysmon
references: null

name: Conti Common Exec parameter
id: 624919bc-c382-11eb-adcc-acde48001122
version: 15
creation_date: '2021-06-04'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of suspicious command-line arguments commonly associated with Conti ransomware, specifically targeting local drives and network shares for encryption. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential ransomware attack, which can lead to widespread data encryption and operational disruption. If confirmed malicious, the impact could be severe, resulting in data loss, system downtime, and potential ransom demands.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process IN ("*-m local", "*-m local *", "*-m net", "*-m net *", "*-m all","*-m all *", "*-nomutex", "*-nomutex *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `conti_common_exec_parameter_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: 3rd party tool may have commandline parameter that can trigger this detection.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Ransomware
    - Compromised Windows Host
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1204
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6135.6624'
title: Credentials in Registry
description: 'Adversaries may search the Registry on compromised systems for insecurely
  stored credentials. The Windows Registry stores configuration information that can
  be used by the system or other programs. -- Threat Actor Association: Antlion, APT10/Cicada,
  APT27/Emissary Panda, APT41, Flax Typhoon, Lancefly, Lazarus, Mustang Panda (aka.
  Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA428, Tropic
  Trooper, Volt Typhoon - Software Association: Akira, AZORLUT, Blackcat/ALPHV, CL-STA-0043,
  DatopLoader, Diavol, Play, PYSA/Mespinoza, QAKBOT, Ransom Cartel, Rhysida, TorrentLocker,
  Tricky Pyxie, Yanluowang -- Atomics T1003.002 Test #1 Atomics T1003.003 Test #2
  Atomics T1003.004 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(reg) AND TERM(query) AND ((TERM(HKLM) OR
  TERM(HKCU)) AND TERM(password) AND TERM(REG_SZ)) OR TERM(Winlogon) OR TERM(SNMP)
  OR TERM(Sessions) OR (TERM(WinVNC4) AND TERM(password))) OR (TERM(reg) AND TERM(save)
  AND (TERM(system) OR TERM(SAM) OR TERM(security))) | table _time, host, user, process,
  process_*, parent_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- credential-access:unsecured credentials:credentials in registry
technique_id:
- T1552.002
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf
- https://assets.sentinelone.com/labs/sentinel-one-valak-i

id: '6133.6622'
title: CSC Execution
description: 'CSC.exe is a binary file used by .NET to compile C# code. Adversaries
  may attempt to make payloads difficult to discover and analyze by delivering files
  to victims as uncompiled code. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  -- Software Association: Clop -- Atomics T1010 Test #1 Atomics T1127.001 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(csc) OR "csc.exe" OR TERM(cvtres) OR "cvtres.exe")
  | table _time, host, user, signature_id, process, process_*, parent_process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:compile after delivery
technique_id:
- T1027.004
data_category:
- Windows event logs
references:
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
- https://unit42.paloaltonetworks.com/unit42-cardinal-rat-active-two-years/

name: Detect Use of cmd exe to Launch Script Interpreters
id: b89919ed-fe5f-492c-b139-95dbb162039e
version: 16
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: |
    The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives.
    It focuses on executions originating from user-writable directories such as Users, AppData, Temp, and Downloads, which are commonly abused by attackers to stage and execute malicious scripts, while excluding trusted system paths like C:\Windows\System32\ and C:\Program Files\ that are typically associated with legitimate activity.
    The detection also filters out service accounts (e.g., accounts ending with $ or known naming conventions) to minimize noise from automated processes and incorporates command-line context to better assess script execution patterns and identify potentially suspicious behavior.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.parent_process_name="cmd.exe"
    (
        Processes.process_name IN ("cscript.exe", "wscript.exe")
        OR
        Processes.original_file_name IN ("cscript.exe", "wscript.exe")
    )
    NOT Processes.process IN (
        "* \"C:\\Program Files (x86)\\*",
        "* \"C:\\Program Files\\*",
        "* \"C:\\Windows\\System32\\*",
        "* \"C:\\Windows\\SysWOW64\\*",
        "* C:\\Program Files (x86)\\*",
        "* C:\\Program Files\\*",
        "* C:\\Windows\\System32\\*",
        "* C:\\Windows\\SysWOW64\\*"
    )
    NOT Processes.user="*$"
    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    This detection may still generate alerts from legitimate administrative or enterprise activity, particularly in environments that rely on logon scripts, software deployment tools (e.g., SCCM, Intune), legacy applications, or IT automation frameworks that execute scripts via cmd.exe. Some organizations may also have internally developed scripts that run from user-writable directories, which can appear suspicious but are benign. Additionally, environments with non-standard application installations or portable tools may trigger this detection.
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://redcanary.com/threat-detection-report/techniques/windows-command-shell/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: cmd.exe launched a script interpreter [$process_name$] with CommandLine [$process$] on [$dest$]
threat_objects:
    - field: process
      type: process
analytic_story:
    - Emotet Malware DHS Report TA18-201A
    - Suspicious Command-Line Executions
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1059.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '23357.42539'
title: ISO File in Temp Folder
description: Threat actors may rely upon a user opening a malicious file in order
  to gain execution. Users may be subjected to social engineering to get them to open
  a file that will lead to code execution. This use case detects file events involving
  AppData Temp folder locations involving zip and ISO files, as observed with Qakbot
  from end of July 2022. Event 4656 and/or 4663 are required for detection. To specifically
  audit file creations, enable object access auditing and configure auditing on the
  directories \AppData\Local\Temp and AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") ("\\AppData\\Local\\Temp"
  OR "\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content\\Outlook") ".zip" ".iso"
  | where match(process_path, "(?i)(\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5cINetCache\x5cContent\.Outlook|\x5cAppData\x5cLocal\x5cTemp).*\.zip\x5c")
  and match(ObjectName, "(?i)\.iso($|\")") | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://www.microsoft.com/en-us/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/

name: Linux Auditd AI CLI Permission Override Activated
id: 737e8baa-d44e-4fa9-8281-24056ed424c0
version: 3
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    This detection identifies when an AI command-line tool is launched in an unsafe mode that bypasses normal safety checks and user approvals.
    For instance, running claude --dangerously-skip-permissions skips all safety restrictions, allowing the tool to operate freely, while gemini --yolo automatically approves all actions without prompting the user.
    These modes, often called permission overrides or YOLO mode, let the AI execute commands, modify files, or perform tasks without confirmation.
    Detecting their use is important to prevent unintended or potentially harmful operations.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd` (proctitle = "*gemini*" AND proctitle IN ("*--yolo*", "*-y *")) OR
    (proctitle = "*claude*" AND proctitle= "*--dangerously-skip-permissions*")
    | rename host as dest
    | stats count min(_time) as firstTime max(_time) as lastTime
      BY proctitle dest
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)` | `linux_auditd_ai_cli_permission_override_activated_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: An administrator or network operator might execute this command legitimately. Please apply the necessary filters to tune that activity.
references:
    - https://x.com/Mandiant/status/2031097693620081042?s=20
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to bypass AI safety execution with permission override.
analytic_story:
    - QuietVault
asset_type: Endpoint
mitre_attack_id:
    - T1480
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Hardware Addition SwapOff
id: c1eea697-99ed-44c2-9b70-d8935464c499
version: 11
creation_date: '2023-02-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "swapoff"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `linux_hardware_addition_swapoff_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed.
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a $process_name$ swap off paging device on $dest$
        - field: user
          type: user
          score: 20
          message: a $process_name$ swap off paging device on $dest$
analytic_story:
    - AwfulShred
    - Data Destruction
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1200
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux UDEV Rule Created
id: 94d0e307-beae-4f85-8150-69c169b979c1
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Filesystem WHERE

    Filesystem.file_path IN (
        "/etc/udev/rules.d/*",
        "/usr/lib/udev/rules.d/*"
    )

    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.process_guid
       Filesystem.process_id Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_udev_rule_created_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: New UDEV rule created under [$file_path$] by [$user$] on [$dest$]
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Persistence Techniques
    - Linux Post-Exploitation
    - Linux Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1547
    - T1037
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5998.6374'
title: Logon Script Registry Key added
description: 'Adversaries may use Windows logon scripts automatically executed at
  logon initialization to establish persistence. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(reg) OR "reg.exe") TERM(add) TERM(UserInitMprLogonScript)
  | table _time, host, user process, process_*, singature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon initialization scripts:logon script (windows)
- privilege-escalation:boot or logon initialization scripts:logon script (windows)
technique_id:
- T1037.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://blog.morphisec.com/cobalt-gang-2.0

id: '20390.36170'
title: Possible Credential Dumping via Windows Network Providers
description: 'A Network Provider is a Windows component that facilitates the connection,
  communication, and resource sharing between a system and a network. Threat actors
  can create a rogue Network Provider to capture or "dump" credentials by intercepting
  and logging network authentication requests, such as NPPSpy. This use case detects
  modifications to registry values for Network Providers. Atomics T1003 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(New-Item) OR
  TERM(New-ItemProperty) OR TERM(Set-ItemProperty) OR TERM(sp) OR TERM(Set-Item) OR
  TERM(sip)) ("SYSTEM\\CurrentControlSet\\Services" "NetworkProvider") OR "SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- credential-access:os credential dumping
technique_id: 
- T1112
- T1003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.socinvestigation.com/credential-dumping-using-windows-network-providers-how-to-respond/
- https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/
- https://github.com/gtworek/PSBits/blob/master/PasswordStealing/NPPSpy/Get-NetworkProviders.ps1

id: '31298.56019'
title: PowerHuntShares Commands
description: Adversaries may look for folders and drives shared on remote systems
  as a means of identifying sources of information to gather as a precursor for Collection
  and to identify potential systems of interest for Lateral Movement. Networks often
  contain shared network drives and folders that enable users to access file directories
  on various systems across a network. Adversaries may attempt to get a listing of
  valid accounts, usernames, or email addresses on a system or within a compromised
  environment. This information can help adversaries determine which accounts exist,
  which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks,
  or account takeovers (e.g., Valid Accounts). Adversaries may attempt to get a listing
  of other systems by IP address, hostname, or other logical identifier on a network
  that may be used for Lateral Movement from the current system. This use case detects
  PowerHuntShares' commands used for network share/account/remote system discovery.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" TERM(EventCode=4103) OR "<EventID>4103<") (TERM(Invoke-HuntSMBShares)
  OR TERM(Get-CardCreationTime) OR TERM(Get-CardLastAccess) OR TERM(Get-CardLastModified)
  OR TERM(Get-PercentDisplay) OR TERM(Get-ExPrivSumData) OR TERM(Get-GroupOwnerBar)
  OR TERM(Get-GroupNameBar) OR TERM(Get-GroupFileBar) OR TERM(Get-UserAceCounts) OR
  TERM(Convert-DataTableToHtmlTable) OR TERM(Convert-DataTableToHtmlReport) OR TERM(Get-FolderGroupMd5)
  OR TERM(Get-LdapQuery) OR TERM(Get-DomainSubnet) OR TERM(Invoke-Parallel) OR TERM(checkSubnet))
  | table _time, host, user, process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:network share discovery
- discovery:account discovery
- discovery:remote system discovery
technique_id: 
- T1135
- T1087
- T1018
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1135/
- https://attack.mitre.org/techniques/T1087/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/NetSPI/PowerHuntShares/tree/main
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/

name: Process Kill Base On File Path
id: 5ffaa42c-acdb-11eb-9ad3-acde48001122
version: 15
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of `wmic.exe` with the `delete` command to remove an executable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because it often indicates the initial stages of an adversary setting up malicious activities, such as cryptocurrency mining, on an endpoint. If confirmed malicious, this behavior could allow an attacker to disable security tools or other critical processes, facilitating further compromise and persistence within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic`
        AND
        Processes.process="*process*"
        AND
        Processes.process="*executablepath*"
        AND
        Processes.process="*delete*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `process_kill_base_on_file_path_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
finding:
    title: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$
analytic_story:
    - XMRig
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '28613.52077'
title: Rundll32 Spawned by Disk Cleanup
description: The Windows Disk Cleanup utility is a legacy tool designed to delete
  cache and temporary files to improve system performance and free up hard disk space.
  It is possible to abuse the utility to establish persistence by executing arbitrary
  code when Disk Cleanup is initiated via COM hijacking. This use case detects rundll32.exe
  processes launched by CleanMgr.exe (Disk Cleanup binary), indicating potential COM
  hijacking has taken place. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "cleanmgr" "rundll32" | where match(parent_process_name,
  "(?i)cleanmgr\.exe") and match(process_name, "(?i)rundll32\.exe") | table _time,
  host, user, parent_*, process, process_* | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- Windows event logs
references:
- https://pentestlab.blog/2024/01/29/persistence-disk-clean-up/
- https://cocomelonc.github.io/persistence/2022/11/16/malware-pers-19.html
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/

name: Single Letter Process On Endpoint
id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects processes with names consisting of a single letter, which is often indicative of malware or an attacker attempting to evade detection. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because attackers use such techniques to obscure their presence and carry out malicious activities like data theft or ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized access, data exfiltration, or system compromise. Immediate investigation is required to determine the legitimacy of the process.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
      from datamodel=Endpoint.Processes where
      Processes.process_name IN (
        "_.exe",
        "-.exe",
        ",.exe",
        ";.exe",
        "!.exe",
        "'.exe"
        "(.exe",
        "(.exe",
        ").exe",
        ").exe",
        "@.exe",
        "&.exe",
        "#.exe",
        "%.exe",
        "`.exe",
        "^.exe",
        "+.exe",
        "=.exe",
        "~.exe",
        "$.exe",
        "0.exe",
        "1.exe",
        "2.exe",
        "3.exe",
        "4.exe",
        "5.exe",
        "6.exe",
        "7.exe",
        "8.exe",
        "9.exe",
        "a.exe",
        "b.exe",
        "c.exe",
        "d.exe",
        "e.exe",
        "f.exe",
        "g.exe",
        "h.exe",
        "i.exe",
        "j.exe",
        "k.exe",
        "l.exe",
        "m.exe",
        "N.exe",
        "o.exe",
        "p.exe",
        "q.exe",
        "r.exe",
        "s.exe",
        "t.exe",
        "u.exe",
        "v.exe",
        "w.exe",
        "x.exe",
        "y.exe",
        "z.exe",
      )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `single_letter_process_on_endpoint_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process.
references: []
finding:
    title: A suspicious process $process_name$ with single letter on host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious process $process_name$ with single letter on host $dest$
analytic_story:
    - DHS Report TA18-074A
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: TOR Traffic
id: ea688274-9c06-4473-b951-e4cb7a5d7a45
version: 17
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Bhavin Patel, Splunk
status: production
type: TTP
description: |
    The following analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities.
    It leverages data from Next Generation Firewalls, using the Network_Traffic data model to detect traffic where the application is TOR and the action is allowed.
    This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination.
    If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
data_source:
    - Palo Alto Network Traffic
    - Cisco Secure Firewall Threat Defense Connection Event
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic WHERE
    All_Traffic.app=tor
    All_Traffic.action IN ("allowed", "allow")
    BY All_Traffic.action All_Traffic.app All_Traffic.bytes
       All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest
       All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc
       All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src
       All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport
       All_Traffic.user All_Traffic.vendor_product All_Traffic.rule
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `tor_traffic_filter`
how_to_implement: |
    In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like, Cisco Secure Firewall Threat Defense, Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated.
known_false_positives: |
    No false positives have been identified at this time.
references:
    - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK
    - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks.
finding:
    title: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$
    entity:
        field: src_ip
        type: system
        score: 50
analytic_story:
    - Prohibited Traffic Allowed or Protocol Mismatch
    - Ransomware
    - NOBELIUM Group
    - Command And Control
    - Cisco Secure Firewall Threat Defense Analytics
    - Interlock Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1090.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Trickbot Named Pipe
id: 1804b0a4-a682-11eb-8f68-acde48001122
version: 11
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the creation or connection to a named pipe associated with Trickbot malware. It leverages Sysmon EventCodes 17 and 18 to identify named pipes with the pattern "\\pipe\\*lacesomepipe". This activity is significant as Trickbot uses named pipes for communication with its command and control (C2) servers, facilitating data exfiltration and command execution. If confirmed malicious, this behavior could allow attackers to maintain persistence, execute arbitrary commands, and exfiltrate sensitive information from the compromised system.
data_source:
    - Sysmon EventID 17
    - Sysmon EventID 18
search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: Possible Trickbot namedpipe created on $dest$ by $process_name$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Trickbot
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AppLocker Rare Application Launch Detection
id: 9556f7b7-285f-4f18-8eeb-963d989f9d27
version: 7
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the launch of rarely used applications within the environment, which may indicate the use of potentially malicious software or tools by attackers. It leverages Windows AppLocker event logs, aggregating application launch counts over time and flagging those that significantly deviate from the norm. This behavior is significant as it helps identify unusual application activity that could signal a security threat. If confirmed malicious, this activity could allow attackers to execute unauthorized code, potentially leading to further compromise of the system.
data_source: []
search: |-
    `applocker`
      | spath input=UserData_Xml
      | rename RuleAndFileData.* as *, Computer as dest, TargetUser AS user
      | stats dc(_time) as days, count
        BY FullFilePath dest user
      | eventstats avg(count) as avg, stdev(count) as stdev
      | eval upperBound=(avg+stdev*3), lowerBound=(avg-stdev*3)
      | where count > upperBound OR count < lowerBound
      | `windows_applocker_rare_application_launch_detection_filter`
how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. Note that, an additional method to reduce any false positives would be to add the specific EventCodes - 8003 or 8004 and filter from there.
known_false_positives: False positives are possible if legitimate users are launching applications that are not permitted by AppLocker. It is recommended to investigate the context of the application launch to determine if it is malicious or not. Modify the threshold as needed to reduce false positives.
references:
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/querying-application-control-events-centrally-using-advanced-hunting
analytic_story:
    - Windows AppLocker
asset_type: Endpoint
mitre_attack_id:
    - T1218
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Crowdstrike RTR Script Execution
id: be2bbfff-77c9-4d65-9b7c-97726051534a
version: 2
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
    This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_name="dllhost.exe"
    Processes.parent_process="*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*"
    Processes.process_name="powershell.exe"
    Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_crowdstrike_rtr_script_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate Crowdstrike administrators may use RTR runscript commands for maintenance or troubleshooting. Filter alerts for trusted user activity and approved scripts.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential CrowdStrike RTR script execution observed on $dest$ via $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Malicious PowerShell
    - Living Off The Land
    - Cobalt Strike
    - Suspicious MSHTA Activity
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint