Splunk rules: 2t

name: Azure AD New MFA Method Registered For User
id: 2628b087-4189-403f-9044-87403f777a1b
version: 14
creation_date: '2023-01-30'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an Azure AD account. It leverages Azure AD AuditLogs to identify when a user registers new security information. This activity is significant because adversaries who gain unauthorized access to an account may add their own MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security controls, maintain long-term access, and potentially escalate their privileges within the environment.
data_source:
    - Azure Active Directory User registered security info
search: |-
    `azure_monitor_aad` category=AuditLogs operationName="User registered security info" properties.operationType=Add
      | rename properties.* as *
      | rename targetResources{}.* as *
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action dest user
           src vendor_account vendor_product
           user_agent result resultDescription
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_new_mfa_method_registered_for_user_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
    - https://attack.mitre.org/techniques/T1556/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://twitter.com/jhencinski/status/1618660062352007174
finding:
    title: A new MFA method was registered for user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Compromised User Account
    - Azure Active Directory Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '5380.5490'
title: Clear Windows Event Logs
description: 'Adversaries may clear Windows Event Logs to hide the activity of an
  intrusion. Windows Event Logs are a record of a computer''s alerts and notifications.
  There are three system-defined sources of events: System, Application, and Security,
  with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
  -- Threat Actor Association: APT29/Nobelium, Cadet Blizzard, Lazarus, Memento Team,
  Redfly, Vice Society, Volt Typhoon - Software Association: Blackcat/ALPHV, Cring,
  Lockbit, Lorenz, Ransom Cartel, Rhysida, Trigona - Atomics T1070.001 Test#1 Atomics
  T1070.001 Test#2 Atomics T1070.001 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 ((TERM(Clear-EventLog)
  AND (TERM(-log) OR TERM(-logname))) OR ((TERM(wevtutil.exe) OR TERM(wevtutil)) AND
  (TERM(CL)OR TERM(clear-log))) | table _time, host, user, signature_id, process_name,
  process, user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:indicator removal:clear windows event logs
technique_id:
- T1070.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
- https://www.justice.gov/file/1080281/download

id: '27700.50350'
title: Discovery using CHCP
description: 'CHCP ("Change Code Page" ) is a legitimate Windows command-line utility
  used to display or set the active console''s code page. When run without parameters,
  chcp displays the number of the active console code page, providing information
  about the environment''s locale and language. Threat actors have used been observed
  using chcp during discovery activities during intrusions involving IcedID and Conti
  ransomware. This use case detects chcp executions with no command line parameters
  and a parent process of cmd or PowerShell executed by a non-system account. -- Threat
  Actor Association: APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team)
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("chcp" OR "chcp.com") ("pwsh.exe" OR "powershell.exe" OR "cmd.exe") | where match(process_name,
  "(?i)chcp\.com") and match(process, "(?i)chcp\s+?$") and match(parent_process_name,
  "(?i)(powershell|pwsh|cmd)\.exe") and not match(user, "\$$") | table _time, host,
  user, process, process_*, parent_process_name, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- discovery:system location discovery:system language discovery
technique_id:
- T1614.001
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp

name: ESXi SSH Enabled
id: b8003567-c5b6-445b-8966-ecdacc81c24d
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies SSH being enabled on ESXi hosts, which can be an early indicator of malicious activity. Threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*SSH access has been enabled" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_ssh_enabled_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed. Some Administrators may use SSH for troubleshooting.
finding:
    title: SSH was enabled on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
    - Hellcat Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1021.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '44252.86793'
title: Explorer Child Process with Suspicious Command Line Padding
description: 'Threat actors may abuse command-line padding with whitespace or non-printable
  control characters to hide malicious commands beyond the UI-visible limit, often
  using LNK files to launch payloads via explorer.exe. This technique enables stealthy
  execution by concealing the true command from the user''s view. This use case detects
  processes launched by explorer.exe where the command line contains excessive whitespace
  padding, suggesting hidden execution activity consistent with LNK-based attacks.
  Note: Due to command line logging normalization/sanitization in other log sources,
  Sysmon or EDR logging is recommended for detection. This logic was verified with
  CrowdStrike FDR logs; if your organization uses a different EDR vendor, it is strongly
  recommended to perform the test found in the Threat Examples to validate that your
  logging source is not removing the whitespace padding.'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(explorer) OR "explorer.exe") | where match(process, "[\x09\x0A\x0B\x0C\x0D\x11\x12\x13]|(\n){5,}")
  and parent_process_name="explorer.exe" | table _time, host, user, process, process_path,
  process_name, parent_process_name, parent_process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter
- execution:user execution:malicious file
technique_id:
- T1059
- T1204.002
data_category:
- Windows Sysmon
references:
- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html

name: GetDomainComputer with PowerShell
id: ed550c19-712e-43f6-bd19-6f58f61b3a5e
version: 10
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as `Get-DomainComputer` is part of PowerView, a tool often used by adversaries for domain enumeration and situational awareness. If confirmed malicious, this activity could allow attackers to map out the network, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*Get-DomainComputer*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getdomaincomputer_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use PowerView for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
finding:
    title: Remote system discovery enumeration on $dest$ by $user$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: HTTP Possible Request Smuggling
id: 97d85f98-9d15-41a0-8682-7030454875e7
version: 5
creation_date: '2025-10-21'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users. This detection identifies a common request smuggling technique of using both Content-Length and Transfer-Encoding headers to cause a parsing confusion between the frontend and backend.
data_source:
    - Suricata
search: |-
    `suricata` (http.request_headers{}.name="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*") OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="*Transfer-Encoding*") OR (http.request_headers{}.value="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*") OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="0")
      | rename dest_ip as dest
      | rex field=_raw "request_headers.:\[(?<headers>.*)\]"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, dest_port, src_ip,
           http.url, http.http_method, http.http_user_agent,
           http.protocol, http.status, headers
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `http_possible_request_smuggling_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto. Some of these will need to have all headers dumped to contain the necessary fields.
known_false_positives: False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources.
references:
    - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
    - https://portswigger.net/research/http1-must-die
    - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
    - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
finding:
    title: Possible request smuggling against a web request was detected. The source IP is $src_ip$ and the destination is $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - HTTP Request Smuggling
asset_type: Network
mitre_attack_id:
    - T1071.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Add User Account
id: 51fbcaf2-6259-11ec-b0f3-acde48001122
version: 10
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
data_source:
    - Sysmon for Linux EventID 1
    - Cisco Isovalent Process Exec
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("useradd", "adduser")
        OR
        Processes.process IN ("*useradd *", "*adduser *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_add_user_account_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Setuid Using Setcap Utility
id: 1474459a-302b-4255-8add-d82f96d14cd9
version: 10
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*setcap *")  AND execve_command IN ("*cap_setuid+ep*", "*cap_setuid=ep*", "*cap_net_bind_service+p*", "*cap_net_raw+ep*", "*cap_dac_read_search+ep*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_setuid_using_setcap_utility_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
finding:
    title: A [$execve_command$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the setcap utility.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Crontab Enumeration
id: 8ef82980-0e95-43d7-a802-b488b668d14f
version: 1
creation_date: '2026-09-03'
modification_date: '2026-09-03'
author: Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk
status: production
type: Hunting
description: |-
    The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems.
    Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities.
    The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment.
data_source:
    - Sysmon for Linux EventID 1
    - Cisco Isovalent Process Exec
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process_name = "crontab"
    Processes.process= "* -l*"

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_crontab_enumeration_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
analytic_story:
    - Cisco Isovalent Suspicious Activity
    - Industroyer2
    - Linux Privilege Escalation
    - Linux Living Off The Land
    - Data Destruction
    - Linux Persistence Techniques
    - Scheduled Tasks
    - Gomir
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Monitor Web Traffic For Brand Abuse
id: 134da869-e264-4a8f-8d7e-fcd0ec88f301
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: TTP
description: The following analytic identifies web requests to domains that closely resemble your monitored brand's domain, indicating potential brand abuse. It leverages data from web traffic sources, such as web proxies or network traffic analysis tools, and cross-references these with known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or other malicious activities targeting your brand. If confirmed malicious, attackers could deceive users, steal credentials, or distribute malware, leading to significant reputational and financial damage.
data_source: []
search: |
    | tstats `security_content_summariesonly`
      values(Web.url) as urls
      min(_time) as firstTime
      from datamodel=Web
      by Web.src
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse
    | search domain_abuse=true
    | `monitor_web_traffic_for_brand_abuse_filter`
how_to_implement: You need to ingest data from your web traffic. This can be accomplished by indexing data from a web proxy, or using a network traffic analysis tool, such as Bro or Splunk Stream. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Potential brand abuse discovered in web logs from $src$
    entity:
        field: src
        type: system
        score: 50
analytic_story:
    - Brand Monitoring
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network
baselines:
    - DNSTwist Domain Names

id: '22128.39014'
title: mshta.exe File Download
description: 'mshta.exe is a Windows utility used for executing HTML applications
  and can be abused by adversaries to download files. This use case detects executions
  of mshta.exe with URLs in the command line. LOLBINS/LOLBAS -- Threat Actor Association:
  LockBit'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "mshta.exe" | regex process="(?i)(http|ftp)s?:\/\/"
  | table _time, host, user, signature_id, process, process_*, parent_process_path,
  parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1105
- T1218.005
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- https://www.falconguard.cz/post/top-10-lol-binaries-and-techniques-used-by-cyber-threat-actors

id: '6589.18040'
title: NTDSUtil.exe execution
description: 'ntdsutil.exe is a native Windows command line utility used to export
  Active Directory. Adversaries can utilize ntdsutil to potential dump credentials
  from files like ntds.dit. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  Threat Actor Association: APT29/Nobelium/Cozy Bear, CL-STA-0043, FIN6, FIN12, Lapsus$,
  TA428, Trickbot, Vice Society, Volt Typhoon, Wizard Spider Software Association:
  ALPHV/BlackCat, Bazar, BianLian, Conti, Hafnium, Lockbit, Prestige, Vice Society
  -- Atomics T1003.003 Test #3 -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ntdsutil" | table _time, host, user user, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:os credential dumping
technique_id:
- T1003.003
- T1003
data_category:
- Windows Sysmon
references:
- https://adsecurity.org/?p=2398#CreateIFM
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Ntdsutil/#dump

id: '28886.52418'
title: Potential Exposed SMB_RDP Port - Windows
description: Threat actors may attempt to exploit a weakness in an Internet-facing
  host or system to initially access a network. The weakness in the system can be
  a software bug, a temporary glitch, or a misconfiguration. This use case detects
  successful network logon events (event 4624, Type 3) events with an external source
  IP, which indicates that logon events are being attempted from external IPs.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12,
  192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) | iplocation src_ip prefix=geo
  | where geoCountry!=""| table _time, host, user user, process_name, process_path,
  src_country, src_dns, src_ip, geo_* | bin span=30s | stats values(*) as * by _time,
  host, user '
techniques:
- initial-access:exploit public-facing application
technique_id: 
- T1190
data_category:
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login/
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html

id: '1106.1172'
title: RDP Enabled
description: 'Detects if RDP service has been enabled on Windows host -- Threat Actor
  Association: APT35/Phosphorus/Magic Hound, DarkSide, BlackMatter, FIN7, TA551, Wizard
  Spider, Yanluowang -- Software Association: BianLian, Black Basta, Conti, Hive,
  IcedID, Insekt, Lockbit, Nefilim, Ryuk Ransomware, Sodinokibi/REvil'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` signature_id=4104 AND (((TERM(reg)
  AND TERM(add)) OR TERM(Set-ItemProperty) ) AND (TERM(fDenyTSConnections) AND "Terminal
  Server") AND ((TERM(REG_DWORD) AND TERM(/d) AND TERM(0)) OR (TERM(-value) AND TERM(0))))
  OR (TERM(netsh) AND TERM(remote) AND TERM(desktop) AND TERM(enable=yes)) OR (TERM(Enable-NetFirewallRule)
  AND TERM(remote) AND TERM(-displaygroup)) | rex field=process mode=sed max_match=0
  "s/(?mi)^(Path:(.+)?)|^(ScriptBlock.+)|^(Creating Scriptblock.+)//g"| rex field=process
  mode=sed "s/[\n\r]+|\s\s+//g" | table _time, host, user process, signature_id |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1112
- T1021.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://pureinfotech.com/enable-remote-desktop-command-prompt-windows-10/

id: '38206.68756'
title: Sliver C2 Implant Activity Pattern
description: Adversaries may abuse command and script interpreters to execute commands,
  scripts, or binaries. These interfaces and languages provide ways of interacting
  with computer systems and are a common feature across many different platforms.
  Most systems come with some built-in command-line interface and scripting capabilities,
  for example, macOS and Linux distributions include some flavor of Unix Shell while
  Windows installations include the Windows Command Shell and PowerShell. This use
  case detects process activity patterns related to Sliver C2 framework implants when
  spawning PowerShell.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(EventCode=4103)
  OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<")) "-NoExit" "-Command"
  "[Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8" | table _time, host, user,
  process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1059/
- https://github.com/BishopFox/sliver/blob/master/implant/sliver/shell/shell_windows.go#L39
- https://sliver.sh/docs?name=Compile+from+Source
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml

name: Windows Computer Account Created by Computer Account
id: 97a8dc5f-8a7c-4fed-9e3e-ec407fd0268a
version: 10
creation_date: '2022-04-28'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies a computer account creating a new computer account with a specific Service Principal Name (SPN) "RestrictedKrbHost". This detection leverages Windows Security Event Logs, specifically EventCode 4741, to identify such activities. This behavior is significant as it may indicate an attempt to establish unauthorized Kerberos authentication channels, potentially leading to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to impersonate services, access sensitive information, or maintain persistence within the network.
data_source:
    - Windows Event Log Security 4741
search: |-
    `wineventlog_security` EventCode=4741 user_type=computer SubjectDomainName!="NT AUTHORITY" ServicePrincipalNames=*RestrictedKrbHost*
      | stats  count min(_time) as firstTime max(_time) as lastTime
        BY dest, subject, action
           ,src_user, user, user_type,
           SubjectUserName,SubjectDomainName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_computer_account_created_by_computer_account_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required.
known_false_positives: It is possible third party applications may have a computer account that adds computer accounts, filtering may be required.
references:
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47
    - https://github.com/Dec0ne/KrbRelayUp
finding:
    title: A Computer Account on $dest$ created by a computer account (possibly indicative of Kerberos relay attack).
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - Local Privilege Escalation With KrbRelayUp
asset_type: Endpoint
mitre_attack_id:
    - T1558
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5704.5966'
title: Windows FTP Exfiltration
description: 'FTP is a utility commonly available with operating systems to transfer
  information over the File Transfer Protocol (FTP). Adversaries can use it to transfer
  other tools onto a system or to exfiltrate data. - Threat Actor Association: APT35,
  Karakurt - Software Association: Agent Tesla, BianLian, Diavol, PureCrypter'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) TERM(ftp)
  | regex process="(?i)ftp\s+(.{1,})?\-s\:.{1,}\.\w{2,5}" | table _time, host, user
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:application layer protocol:file transfer protocols
- exfiltration:exfiltration over alternative protocol
technique_id:
- T1071.002
- T1048
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://book.hacktricks.xyz/exfiltration

name: Windows Multiple Account Passwords Changed
id: faefb681-14be-4f0d-9cac-0bc0160c7280
version: 11
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects instances where more than five unique Windows account passwords are changed within a 10-minute interval. It leverages Event Code 4724 from the Windows Security Event Log, using the wineventlog_security dataset to monitor and count distinct TargetUserName values. This behavior is significant as rapid password changes across multiple accounts are unusual and may indicate unauthorized access or internal compromise. If confirmed malicious, this activity could lead to widespread account compromise, unauthorized access to sensitive information, and potential disruption of services.
data_source:
    - Windows Event Log Security 4724
search: |-
    `wineventlog_security` EventCode=4724 status=success
      | bucket span=10m _time
      | stats count dc(user) as unique_users values(user) as user values(dest) as dest
        BY EventCode signature _time
           src_user SubjectDomainName TargetDomainName
           Logon_ID
      | where unique_users > 5
      | `windows_multiple_account_passwords_changed_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/
finding:
    title: User $src_user$ changed the passwords of multiple accounts in a short period of time.
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple Users Failed To Authenticate From Host Using NTLM
id: 7ed272a4-9c77-11eb-af22-acde48001122
version: 13
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a single source endpoint failing to authenticate with 30 unique valid users using the NTLM protocol. It leverages EventCode 4776 from Domain Controller logs, focusing on error code 0xC000006A, which indicates a bad password. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access to sensitive information or further compromise of the Active Directory environment.
data_source:
    - Windows Event Log Security 4776
search: |-
    `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
      | bucket span=5m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts values(dest) as dest
        BY _time, Workstation
      | where unique_accounts > 30
      | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
finding:
    title: Potential NTLM based password spraying attack from $Workstation$
    entity:
        field: Workstation
        type: system
        score: 50
analytic_story:
    - Active Directory Password Spraying
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Raccine Scheduled Task Deletion
id: c9f010da-57ab-11ec-82bd-acde48001122
version: 14
creation_date: '2021-12-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the deletion of the Raccine Rules Updater scheduled task using the `schtasks.exe` command. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because adversaries may delete this task to disable Raccine, a tool designed to prevent ransomware attacks. If confirmed malicious, this action could allow ransomware to execute without interference, leading to potential data encryption and loss.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=schtasks.exe Processes.process="*delete*"
        AND
        Processes.process="*Raccine*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_raccine_scheduled_task_deletion_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, however filter as needed.
references:
    - https://redcanary.com/blog/blackbyte-ransomware/
    - https://github.com/Neo23x0/Raccine
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Raccines scheduled task.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Raccines scheduled task.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Ransomware
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '12916.18557'
title: WMIC Explicit Credentials
description: 'Prior to the first lateral movement, threat actors may test credentials
  and gather information from their targeted remote server using WMI.Living Off the
  Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Association: Flax Typhoon,
  Volt Typhoon (Bronze Silhouette, Vanguard Panda) - Software Association: Clop, Quantum'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("wmic" OR "wmic.exe") ("/password") | table _time, host, user process, process_*,
  signature_id, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:valid accounts
- privilege-escalation:valid accounts
- execution:windows management instrumentation
- discovery:remote system discovery
technique_id: 
- T1078
- T1047
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/04/25/quantum-ransomware/