Splunk rules: 2u

name: ASL AWS Credential Access RDS Password reset
id: d15e9bd9-ef64-4d84-bc04-f62955a9fee8
version: 9
creation_date: '2022-08-07'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs from Amazon Security Lake to identify events where the `ModifyDBInstance` API call includes a new `masterUserPassword` parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=ModifyDBInstance OR api.operation=ModifyDBCluster
      | spath input=api.request.data
      | search masterUserPassword=*
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region api.request.data
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_credential_access_rds_password_reset_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: Users may genuinely reset the RDS password.
references:
    - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
finding:
    title: User $user$ is seen to reset the password for database
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1110
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD Device Code Authentication
id: d68d8732-6f7e-4ee5-a6eb-737f2b990b91
version: 12
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran,  Splunk
status: production
type: TTP
description: The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). It leverages Azure AD SignInLogs to detect suspicious authentication requests using the device code authentication protocol. This activity is significant as it indicates potential bypassing of Multi-Factor Authentication (MFA) and Conditional Access Policies (CAPs) through phishing emails. If confirmed malicious, attackers could gain unauthorized access to Azure AD, Exchange mailboxes, and Outlook Web Application (OWA), leading to potential data breaches and unauthorized data access.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` category=SignInLogs "properties.authenticationProtocol"=deviceCode
      | rename properties.* as *
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           category
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_device_code_authentication_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: In most organizations, device code authentication will be used to access common Microsoft service but it may be legitimate for others. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1528
    - https://github.com/rvrsh3ll/TokenTactics
    - https://embracethered.com/blog/posts/2022/device-code-phishing/
    - https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html
    - https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
finding:
    title: Device code requested for $user$ from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1528
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

id: '44644.87463'
title: Command Line Homoglyphs - Windows
description: Threat actors may use homoglyph attacks by substituting characters in
  process names or commands with visually similar Unicode symbols to impersonate legitimate
  commands, or messages (e.g., using Cyrillic “а” instead of Latin “a”). This tactic
  is often used to evade string-based detection and confuse analysts during investigation.
  This use case detects Windows processes containing Unicode characters from commonly
  abused homoglyph ranges, including Cyrillic extended, Greek extended, and full-width
  Latin letters and digits.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR zTERM(EventCode=4104) OR "<EventID>4104<") | regex process="\w+([Ѐ-ӿ]+|[Ͱ-Ͽ]+)"
  | table _time, host, user, process, process_name, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:command obfuscation
technique_id:
- T1027.010
data_category:
- PowerShell logs
references:
- https://app.any.run/tasks/c044f84a-fd44-47ab-b53f-976debf96e63
- https://www.zdnet.com/article/magecart-group-uses-homoglyph-attacks-to-fool-you-into-visiting-malicious-websites/
- https://www.meshsecurity.io/blog/homoglyph-attacks-understanding-and-mitigating-the-threat
- https://www.bitdefender.com/en-us/blog/businessinsights/homograph-phishing-attacks-when-user-awareness-is-not-enough

name: Detect Web Access to Decommissioned S3 Bucket
id: 3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f
version: 5
creation_date: '2025-02-12'
modification_date: '2026-05-13'
author: Jose Hernandez, Splunk
status: experimental
type: Anomaly
description: This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. This activity is significant because attackers may attempt to access or recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
data_source:
    - AWS Cloudfront
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Web.http_method) as http_method values(Web.http_user_agent) as http_user_agent values(Web.url) as url values(Web.user) as user FROM datamodel=Web
      WHERE Web.url_domain!=""
      BY Web.src Web.url_domain
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | eval bucket_domain = lower(url_domain)
    | lookup decommissioned_buckets bucketName as bucket_domain OUTPUT bucketName as match
    | where isnotnull(match)
    | `detect_web_access_to_decommissioned_s3_bucket_filter`
how_to_implement: To successfully implement this detection, you need to be ingesting web proxy logs and have them mapped to the Web data model. Additionally, ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is running and populating the decommissioned_buckets KVStore Lookup.
known_false_positives: Some applications or web pages may continue to reference old S3 bucket URLs after they have been decommissioned. These should be investigated and updated to prevent potential security risks.
references:
    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
    - https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A web request to decommissioned S3 bucket domain $url_domain$ was detected from host $src$ by user $user$
threat_objects:
    - field: url_domain
      type: domain
analytic_story:
    - AWS S3 Bucket Security Monitoring
    - Data Destruction
asset_type: S3 Bucket
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network
baselines:
    - Baseline Of Open S3 Bucket Decommissioning

id: '45179.90471'
title: Exfiltration via curl.exe - Windows
description: Threat actors may abuse curl.exe on Windows systems to exfiltrate data
  or upload files to remote servers using command-line options like -d, -T, --form,
  or --upload-file. These flags are commonly used for HTTP POST requests, enabling
  attackers to transmit files or sensitive information during post-compromise activity.
  This use case detects process creation events where curl.exe is used with data or
  file upload arguments, potentially indicating data exfiltration, C2 communication,
  or malicious use of legitimate tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(curl) ("-d" OR
  "-T" OR "-F" OR " --form" OR "--upload-file " OR "--data " OR "--data-") | where
  match(process, "(?i)curl") and (match(process, "\s-[dTF]\s") or match(process, "(?i)\s--(form|upload-file|data)\s|\s--data-"))
  | table _time, host, user, process, process_path, process_name, parent_process_name,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- PowerShell logs
references:
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
- https://x.com/d1r4c/status/1279042657508081664
- https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- https://curl.se/docs/manpage.html

name: Fsutil Zeroing File
id: 4e5e024e-fabb-11eb-8b8f-acde48001122
version: 12
creation_date: '2021-08-11'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the 'fsutil' command with the 'setzerodata' parameter, which zeros out a target file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because it is a technique used by ransomware, such as LockBit, to evade detection by erasing its malware path after encrypting the host. If confirmed malicious, this action could hinder forensic investigations and allow attackers to cover their tracks, complicating incident response efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=fsutil.exe Processes.process="*setzerodata*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `fsutil_zeroing_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
    - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
finding:
    title: Possible file data deletion on $dest$ using $process$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Ransomware
    - LockBit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6091.18333'
title: Go Run Execution
description: Malicious actors are beginning to turn to Golang as a malware language
  since it is not typically picked up by antivirus software. Although the language
  is about 10 years old, and is used by many legitimate programmers, there has not
  been as much activity with Golang malware. This use case looks for run executions
  by go.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(GO) OR "go.exe") TERM(RUN) | rex field=process (?<ioc>"(?i)\S+\.go") | table
  _time, host, user, signature_id, process, process_*, parent_process_* ioc | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://www.f5.com/labs/articles/threat-intelligence/new-golang-malware-is-spreading-via-multiple-exploits-to-mine-mo

id: '1037.1049'
title: Invoke-Expression Command
description: 'Detects when PowerShell Invoke-Expression is executed. -- Threat Group
  Association: Actinium/Gamaredon/Primitive Bear, Andariel, APT29/Nobelium/Cozy Bear,
  APT31, FIN7, FIN8, Lazarus, TA505, TA551, Turla (akaSecret Blizzard, KRYPTON, and
  UAC-0003), WinterVivern/UAC-0114, Winter Vivern, WIRTE, Wizard Spider - Software
  Association: ALPHV/BlackCat, BadHatch, Bazar, Black Basta, Clop, Conti, Cring, IcedID,
  LV, Play, PowerShortShell, PurpleFox, PYSA/Mespinoza, Remcos, SamSam, SquirrelWaffle,
  Trickbot, XingLocker -- #TrendingThreat #Russia #Ukraine -- Atomics T1059.001 Test
  #1 Atomics T1059.001 Test #4 Atomics T1059.001 Test #5 Atomics T1059.001 Test #8
  Atomics T1059.001 Test #11 Atomics T1059.001 Test #13 Atomics T1135 Test #6 Atomics
  T1059.005 Test #2 Atomics T1059.005 Test #3 Atomics T1134.002 Test #2'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (EventCode=4103 AND ("IEX"
  OR "Invoke-Expression")) OR (EventCode=4104 AND ("Invoke-Expression (New-Object
  Net.WebClient).DownloadString" OR "IEX")) | table _time, host, user dvc, dvc_nt_host,
  event_id, eventtype, host, index, parameters, process, process_name, process_path,
  shell, signature_id, source, sourcetype, tag, user, user_id | bin span=60s | stats
  values(*) as * by _time, host | where match(process,"(?i)IEX") OR match(process,"(?i)Invoke-Expression")
  OR match(process,"(?i)Invoke-Expression\s+(New-Object\s+Net\.WebClient)\.DownloadString") '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.1
- https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-powershell
- https://www.cyber.gov.au/acsc/view-all-content/publications/securing-powershell-enterprise
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

id: '15997.24031'
title: Known Process Injection Commands
description: Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. This use case detects PowerShell commands associated
  with process injection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("VirtualAlloc" OR "VirtualAllocEx" OR "VirtualProtect"
  OR "LdrLoadDll" OR "LoadLibrary" OR "LoadLibraryA" OR "LoadLibraryEx" OR "GetProcAddress"
  OR "OpenProcess" OR "OpenProcessToken" OR "AdjustTokenPrivileges" OR "WriteProcessMemory"
  OR "CreateRemoteThread" OR "NtCreateThreadEx" OR "CreateThread" OR "QueueUserAPC"
  OR "SuspendThread" OR "ResumeThread" OR "GetDelegateForFunctionPointer") | table
  _time, host, user process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Windows event logs
- Process command-line parameters
references: null

name: Linux Shell Pseudo Device Reverse Shell
id: f324bc06-8436-4606-8882-0a8fb480b719
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections.
    This special file system interface allows opening a network socket and sending or receiving data using simple shell commands.
    Attackers commonly abuse this native shell capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name IN (
        "bash",
        "dash",
        "sh",
        "zsh"
    )
    Processes.process IN (
        "*/dev/tcp/*",
        "*/dev/udp/*"
    )

    by Processes.process Processes.vendor_product
       Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec
       Processes.action Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    |`linux_shell_pseudo_device_reverse_shell_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes.
    Filter based on known authorized users and trusted source systems.
references:
    - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$].
        - field: user
          type: user
          score: 20
          message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$].
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Post-Exploitation
    - Linux Persistence Techniques
    - Linux Privilege Escalation
    - Command And Control
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1059
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13472.19308'
title: PowerView_SharpView Commands
description: 'Adversaries may attempt to identify the primary user, currently logged
  in user, set of users that commonly uses a system, or whether a user is actively
  using the system. PowerView and its C# implementation SharpView are a series of
  functions that perform network and Windows domain enumeration and exploitation.
  -- Software Association: ALPHV/BlackCat, Rhysida -- Atomics T1033 Test #3 Atomics
  T1069.002 Test #4 Atomics T1069.002 Test #5 Atomics T1069.002 Test #6 Atomics T1069.002
  Test #12 Atomics T1069.002 Test #13 Atomics T1087.002 Test #10 Atomics T1087.002
  Test #11 Atomics T1135 Test #7 Atomics T1201 Test #8 Atomics T1615 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(<EventID>4104<) OR TERM(EventCode=4103) OR TERM(<EventID>4103<)) (TERM(Get-IPAddress)
  OR TERM(Resolve-IPAddress) OR TERM(Convert-NameToSid) OR TERM(ConvertTo-SID) OR
  TERM(Convert-SidToName) OR TERM(ConvertFrom-SID) OR TERM(Request-SPNTicket) OR TERM(Get-DomainSPNTicket)
  OR TERM(Get-DNSZone) OR TERM(Get-DomainDNSZone) OR TERM(Get-DNSRecord) OR TERM(Get-DomainDNSRecord)
  OR TERM(Get-NetDomain) OR TERM(Get-Domain) OR TERM(Get-NetDomainController) OR TERM(Get-DomainController)
  OR TERM(Get-NetForest) OR TERM(Get-Forest) OR TERM(Get-NetForestDomain) OR TERM(Get-ForestDomain)
  OR TERM(Get-NetForestCatalog) OR TERM(Get-ForestGlobalCatalog) OR TERM(Get-NetUser)
  OR TERM(Get-DomainUser) OR TERM(Get-UserEvent) OR TERM(Get-DomainUserEvent) OR TERM(Get-NetComputer)
  OR TERM(Get-DomainComputer) OR TERM(Get-ADObject) OR TERM(Get-DomainObject) OR TERM(Set-ADObject)
  OR TERM(Set-DomainObject) OR TERM(Get-ObjectAcl) OR TERM(Get-DomainObjectAcl) OR
  TERM(Add-ObjectAcl) OR TERM(Add-DomainObjectAcl) OR TERM(Invoke-ACLScanner) OR TERM(Find-InterestingDomainAcl)
  OR TERM(Get-GUIDMap) OR TERM(Get-DomainGUIDMap) OR TERM(Get-NetOU) OR TERM(Get-DomainOU)
  OR TERM(Get-NetSite) OR TERM(Get-DomainSite) OR TERM(Get-NetSubnet) OR TERM(Get-DomainSubnet)
  OR TERM(Get-NetGroup) OR TERM(Get-DomainGroup) OR TERM(Find-ManagedSecurityGroups)
  OR TERM(Get-DomainManagedSecurityGroup) OR TERM(Get-NetGroupMember) OR TERM(Get-DomainGroupMember)
  OR TERM(Get-NetFileServer) OR TERM(Get-DomainFileServer) OR TERM(Get-DFSshare) OR
  TERM(Get-DomainDFSShare) OR TERM(Get-NetGPO) OR TERM(Get-DomainGPO) OR TERM(Get-NetGPOGroup)
  OR TERM(Get-DomainGPOLocalGroup) OR TERM(Find-GPOLocation) OR TERM(Get-DomainGPOUserLocalGroupMapping)
  OR TERM(Find-GPOComputerAdmin) OR TERM(Get-DomainGPOComputerLocalGroupMapping) OR
  TERM(Get-LoggedOnLocal) OR TERM(Get-RegLoggedOn) OR TERM(Invoke-CheckLocalAdminAccess)
  OR TERM(Test-AdminAccess) OR TERM(Get-SiteName) OR TERM(Get-NetComputerSiteName)
  OR TERM(Get-Proxy) OR TERM(Get-WMIRegProxy) OR TERM(Get-LastLoggedOn) OR TERM(Get-WMIRegLastLoggedOn)
  OR TERM(Get-CachedRDPConnection) OR TERM(Get-WMIRegCachedRDPConnection) OR TERM(Get-RegistryMountedDrive)
  OR TERM(Get-WMIRegMountedDrive) OR TERM(Get-NetProcess) OR TERM(Get-WMIProcess)
  OR TERM(Invoke-ThreadedFunction) OR TERM(New-ThreadedFunction) OR TERM(Invoke-UserHunter)
  OR TERM(Find-DomainUserLocation) OR TERM(Invoke-ProcessHunter) OR TERM(Find-DomainProcess)
  OR TERM(Invoke-EventHunter) OR TERM(Find-DomainUserEvent) OR TERM(Invoke-ShareFinder)
  OR TERM(Find-DomainShare) OR TERM(Invoke-FileFinder) OR TERM(Find-InterestingDomainShareFile)
  OR TERM(Invoke-EnumerateLocalAdmin) OR TERM(Find-DomainLocalGroupMember) OR TERM(Get-NetDomainTrust)
  OR TERM(Get-DomainTrust) OR TERM(Get-NetForestTrust) OR TERM(Get-ForestTrust) OR
  TERM(Find-ForeignUser) OR TERM(Get-DomainForeignUser) OR TERM(Find-ForeignGroup)
  OR TERM(Get-DomainForeignGroupMember) OR TERM(Invoke-MapDomainTrust) OR TERM(Get-DomainTrustMapping)
  OR TERM(Get-DomainPolicy) OR TERM(Get-DomainPolicyData) OR TERM(Find-LocalAdminAccess))
  | table _time, host, user process, process_*, signature_id, user | bin span=60s
  | stats values(*) as * by _time, host '
techniques:
- discovery:permission groups discovery:domain groups
- execution:command and scripting interpreter:powershell
- discovery:system owner/user discovery
- discovery:network share discovery
- discovery:system network connections discovery
technique_id:
- T1069.002
- T1059.001
- T1033
- T1135
- T1049
data_category:
- PowerShell logs
references:
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- https://powersploit.readthedocs.io/en/latest/Recon/

name: Prevent Automatic Repair Mode using Bcdedit
id: 7742aa92-c9d9-11eb-bbfc-acde48001122
version: 12
creation_date: '2021-06-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of "bcdedit.exe" with parameters to set the boot status policy to ignore all failures. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because it can indicate an attempt by ransomware to prevent a compromised machine from booting into automatic repair mode, thereby hindering recovery efforts. If confirmed malicious, this action could allow attackers to maintain control over the infected system, complicating remediation and potentially leading to further damage.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*"  Processes.process = "*ignoreallfailures*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `prevent_automatic_repair_mode_using_bcdedit_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may modify the boot configuration ignore failure during testing and debugging.
references:
    - https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf
finding:
    title: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$
analytic_story:
    - Ransomware
    - Chaos Ransomware
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Protocols passing authentication in cleartext
id: 6923cd64-17a0-453c-b945-81ac2d8c6db9
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic
      WHERE NOT All_Traffic.action IN ("blocked", "block")
        AND
        All_Traffic.transport="tcp"
        AND
        (All_Traffic.dest_port="23"
        OR
        All_Traffic.dest_port="143"
        OR
        All_Traffic.dest_port="110"
        OR
        (All_Traffic.dest_port="21"
        AND
        All_Traffic.user != "anonymous"))
      BY All_Traffic.user All_Traffic.src_ip All_Traffic.dest
         All_Traffic.dest_port All_Traffic.rule
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `protocols_passing_authentication_in_cleartext_filter`
how_to_implement: This search requires you to be ingesting your network traffic, and populating the Network_Traffic data model. For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22)
known_false_positives: Some networks may use leverage clear text protocols such as kerberos, FTP or telnet servers. Apply the necessary exclusions where needed.
references:
    - https://www.rackaid.com/blog/secure-your-email-and-file-transfers/
    - https://www.infosecmatter.com/capture-passwords-using-wireshark/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Allowed Traffic from $src_ip$ to $dest$ over port $dest_port$. Which might indicate a potential authentication attempts over a  cleartext protocol.
        - field: dest
          type: system
          score: 20
          message: Allowed Traffic from $src_ip$ to $dest$ over port $dest_port$. Which might indicate a potential authentication attempts over a  cleartext protocol.
threat_objects:
    - field: dest
      type: ip_address
analytic_story:
    - Use of Cleartext Protocols
    - Cisco Secure Firewall Threat Defense Analytics
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '5473.5640'
title: Rubeus Commands
description: 'Rubeus is a C# toolset for raw Kerberos interaction and abuses. -- Threat
  Actor Association: Wizard Spider - Software Association: Conti, Diavol, Quakbot/Qbot
  -- Atomics T1558.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(harvest)
  OR TERM(ptt) OR TERM(s4u) OR TERM(asktgt) OR TERM(brute) OR TERM(createnetonly)
  OR TERM(changepw) OR TERM(hash) OR TERM(tgssub) OR TERM(asktgs) OR TERM(renew) OR
  TERM(describe) OR TERM(monitor) OR TERM(purge) OR TERM(klist) OR TERM(triage) OR
  TERM(dump) OR TERM(tgtdeleg) OR TERM(kerberoast) OR TERM(asreproast) OR TERM(currentluid))
  |regex process="(?i)\.exe\"?\s+(((harvest|ptt|s4u|asktgt|brute|createnetonly|changepw|hash|tgssub|asktgs|renew|describe|monitor)(\s+)?\/\w+\:)|((purge|klist|triage|dump|tgtdeleg|kerberoast|asreproast|currentluid)((\s+)?\/\w+)?))"
  | table _time, host, user, signature_id, process, process_id, process_name, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge kerberos tickets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558
- T1558.003
- T1558.002
- T1558.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/GhostPack/Rubeus

id: '5528.5784'
title: SharpHound Keywords
description: 'Sharphound can be used to collect Active Directory information in order
  to easily identify highly complex attack paths that would otherwise be impossible
  to quickly identify. Once collected information can be utilized by BloodHound to
  apply graph theory in order to reveal the hidden and often unintended relationships
  within an Active Directory environment. -- Threat Actor Association: APT29/Nobelium/Cozy
  Bear, BlackMatter, Carbanak, DarkSide, FIN12, Muddled Libra - Software Association:
  ALPHV/BlackCat, Black Basta, LockBit, Play, Qakbot/Qbot, XingLocker -- #TrendingThreat
  #Russia #Ukraine Atomics T1069.001 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") (((TERM(-c) OR TERM(collectionmethod)) (TERM(default) OR TERM(group)
  OR TERM(localadmin) OR TERM(rdp) OR TERM(dcom) OR TERM(psremote) OR TERM(GPOLocalGroup)
  OR TERM(Session) OR TERM(ComputerOnly) OR TERM(LoggedOn) OR TERM(Trusts) OR TERM(ACL)
  OR TERM(Container) OR TERM(DcOnly) OR TERM(all))) OR ((TERM(-domaincontroller) OR
  TERM(-d)) OR TERM(ldapport) OR TERM(secureldap) OR TERM(ldapusername) OR TERM(ldappassword)
  OR TERM(DisableKerberosSigning) OR TERM(Loop) OR TERM(LoopDuration) OR TERM(LoopInterval)
  OR TERM(-Domain) OR TERM(-Stealth) OR TERM(ExcludeDomainControllers) OR TERM(-ComputerFile)
  OR TERM(LdapFilter) OR TERM(OverrideUserName) OR TERM(RealDNSName) OR TERM(CollectAllProperties)
  OR TERM(WindowsOnly))) |regex process="(?i)(-d|domaincontroller|-c|collectionmethod|DisableKerberosSigning|ldappassword|ldapusername|secureldap|ldapport|loop|OverrideUserName|RealDNSName|CollectAllProperties|WindowsOnly|LdapFilter|ComputerFile|ExcludeDomainControllers|Stealth|Domain)\s"
  | table _time, host, user, process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:account discovery:local account
- discovery:account discovery:domain account
- discovery:domain trust discovery
- discovery:password policy discovery
- discovery:permission groups discovery:domain groups
- discovery:permission groups discovery:local groups
- discovery:system information discovery
technique_id:
- T1087.001
- T1087.002
- T1482
- T1201
- T1069.002
- T1069.001
- T1082
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://github.com/BloodHoundAD/SharpHound3/tree/ee437a5e596bf738b91bfae0aa35d2aab3544a8f

name: Unusually Long Content-Type Length
id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
version: 7
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
data_source: []
search: >-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Web by Web.src Web.dest Web.url Web.http_user_agent Web.http_content_type
    | `drop_dm_object_name("Web")`  | eval http_content_type_length = len(http_content_type)  |
    where http_content_type_length > 100
    | table firstTime lastTime src dest http_content_type_length http_content_type url
    http_user_agent
    | `security_content_ctime(firstTime)`  | `security_content_ctime(lastTime)`  | `unusually_long_content_type_length_filter`
how_to_implement: This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.
known_false_positives: Very few legitimate Content-Type fields will have a length greater than 100 characters.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$
        - field: src
          type: system
          score: 20
          message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$
analytic_story:
    - Apache Struts Vulnerability
asset_type: Web Server
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Windows ComputerDefaults Spawning a Process
id: 697eb4c0-1008-4c3c-b5ae-7bd9b39adbd6
version: 6
creation_date: '2023-09-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the spawning of ComputerDefaults.exe, a Windows system process used to manage default application associations. While normally legitimate, this process can be exploited by attackers to bypass User Account Control (UAC) and execute unauthorized code with elevated privileges. Detection focuses on abnormal execution patterns, unusual parent-child process relationships, or deviations from standard paths. Such behavior may indicate attempts to modify system defaults or run malicious scripts undetected. Monitoring ComputerDefaults.exe is critical to identify potential security threats, prevent privilege escalation, and maintain system integrity by distinguishing normal operations from suspicious activity.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=ComputerDefaults.exe
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_computerdefaults_spawning_a_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
finding:
    title: A ComputerDefaults.exe process $parent_process_name$ spawning child process $process_name$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Castle RAT
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Domain Admin Impersonation Indicator
id: 10381f93-6d38-470a-9c30-d25478e3bd3f
version: 12
creation_date: '2023-10-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges.
data_source:
    - Windows Event Log Security 4627
search: |-
    `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*")
      | where match(GroupMembership, "Domain Admins")
      | stats count
        BY _time TargetUserName GroupMembership
           action app dest
           signature_id user vendor_product
      | lookup domain_admins username as TargetUserName OUTPUT username
      | fillnull value=NotDA username
      | search username = "NotDA"
      | `windows_domain_admin_impersonation_indicator_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, the Audit Group Membership subcategory within the Logon Logoff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table.
known_false_positives: False positives may trigger the detections certain scenarios like directory service delays or out of date lookups. Filter as needed.
references:
    - https://trustedsec.com/blog/a-diamond-in-the-ruff
    - https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks
    - https://github.com/GhostPack/Rubeus/pull/136
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627
finding:
    title: $TargetUserName$ may be impersonating a Domain Administrator through a forged Kerberos ticket.
    entity:
        field: TargetUserName
        type: user
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - Gozi Malware
    - Compromised Windows Host
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1558
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Known GraphicalProton Loaded Modules
id: bf471c94-0324-4b19-a113-d02749b969bc
version: 13
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\ModeBitmapNumericAnimate.dll", "*\\UnregisterAncestorAppendAuto.dll", "*\\DeregisterSeekUsers.dll", "*\\ScrollbarHandleGet.dll", "*\\PerformanceCaptionApi.dll", "*\\WowIcmpRemoveReg.dll", "*\\BlendMonitorStringBuild.dll", "*\\HandleFrequencyAll.dll", "*\\HardSwapColor.dll", "*\\LengthInMemoryActivate.dll", "*\\ParametersNamesPopup.dll", "*\\ModeFolderSignMove.dll", "*\\ChildPaletteConnected.dll", "*\\AddressResourcesSpec.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_graphicalproton_loaded_modules_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Windows Known GraphicalProton backdoor Loaded Modules on $dest$.
analytic_story:
    - Hellcat Ransomware
    - CISA AA23-347A
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1574.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint