Splunk rules: 2w

name: Allow Inbound Traffic In Firewall Rule
id: a5d85486-b89c-11eb-8267-acde48001122
version: 13
creation_date: '2021-05-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects a suspicious PowerShell command that allows inbound traffic to a specific local port within the public profile. It leverages PowerShell script block logging (EventCode 4104) to identify commands containing keywords like "firewall," "Inbound," "Allow," and "-LocalPort." This activity is significant because it may indicate an attacker attempting to establish remote access by modifying firewall rules. If confirmed malicious, this could allow unauthorized access to the machine, potentially leading to further exploitation and data exfiltration.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*firewall*" ScriptBlockText = "*Inbound*" ScriptBlockText = "*Allow*"  ScriptBlockText = "*-LocalPort*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `allow_inbound_traffic_in_firewall_rule_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
known_false_positives: administrator may allow inbound traffic in certain network or machine.
references:
    - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
finding:
    title: Suspicious firewall modification detected on endpoint $dest$ by user $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious firewall modification detected on endpoint $dest$ by user $user_id$.
analytic_story:
    - Prohibited Traffic Allowed or Protocol Mismatch
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Common Ransomware Notes
id: ada0f478-84a8-4641-a3f1-d82362d6bd71
version: 16
creation_date: '2019-10-16'
modification_date: '2026-07-02'
author: David Dorsey, Splunk
status: production
type: Hunting
description: |
    The following analytic detects the creation of files with names commonly associated with ransomware notes.
    It leverages file-system activity data from the Endpoint Filesystem data model, typically populated by endpoint detection and response (EDR) tools or Sysmon logs.
    This activity is significant because ransomware notes indicate a potential ransomware attack, which can lead to data encryption and extortion.
    If confirmed malicious, this activity could result in significant data loss, operational disruption, and financial impact due to ransom demands.
    Note that this analytic relies on a lookup table (ransomware_notes_lookup) that contains known ransomware note file names.
    Ensure that this lookup table is regularly updated to include new ransomware note file names as they are identified in the threat landscape.
    Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count
      min(_time) as firstTime
      max(_time) as lastTime
      values(Filesystem.user) as user
      values(Filesystem.dest) as dest
      values(Filesystem.file_path) as file_path

    FROM datamodel=Endpoint.Filesystem WHERE
    Filesystem.action IN (
        "created",
        "modified"
    )
    [
      | inputlookup ransomware_notes_lookup
      | search status=true
      | fields ransomware_notes
      | dedup ransomware_notes
      | rename ransomware_notes as Filesystem.file_name
    ]
    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
       Filesystem.process_guid Filesystem.process_id Filesystem.user
       Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `common_ransomware_notes_filter`
how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
known_false_positives: |
    There could be cases where a legitimate file coincidentally matches a known ransomware note
    name. In such cases, further investigation is required to determine the nature of the file and its context.
references: []
analytic_story:
    - Chaos Ransomware
    - Rhysida Ransomware
    - Ransomware
    - LockBit Ransomware
    - Medusa Ransomware
    - SamSam Ransomware
    - Clop Ransomware
    - Ryuk Ransomware
    - Black Basta Ransomware
    - Termite Ransomware
    - Interlock Ransomware
    - NailaoLocker Ransomware
    - Hellcat Ransomware
    - Storm-0501 Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '45491.91373'
title: Data Exfiltration via AWS CLI - Windows
description: Threat actors may abuse the AWS CLI s3 cp command with recursive and
  custom endpoint flags to exfiltrate large volumes of data to an S3-compatible storage
  service outside of the target environment. The use of --recursive, --region, and
  --endpoint-url flags together is indicative of bulk data transfers, potentially
  to unauthorized or attacker-controlled storage. This use case detects such activity
  on Windows systems, helping identify suspicious data movement or staging for exfiltration.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "s3 " " cp " " --recursive" " --region" " --endpoint-url"
  | table _time, host, user, process, parent_process_name, process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
- https://x.com/Kostastsale/status/1714343784799223877

name: Linux c89 Privilege Escalation
id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'c89' command with elevated privileges, which can be used to compile and execute C programs as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events that include command-line arguments. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute arbitrary commands as root. If confirmed malicious, this could lead to full system compromise, enabling the attacker to gain root access and execute any command with elevated privileges.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*c89*"
        AND
        Processes.process="*-wrapper*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_c89_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/c89/
    - https://www.ibm.com/docs/en/zos/2.1.0?topic=guide-c89-compiler-invocation-using-host-environment-variables
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '40510.74082'
title: LocalAccountTokenFilterPolicy Registry Value Modified
description: The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  key is responsible for controlling how local accounts are filtered when they are
  used to access a Windows system remotely. By setting the key to value '1', it effectively
  disables Remote UAC filtering for local accounts, allowing local admin accounts
  to use elevated tokens (with full admin rights when connecting remotely). This may
  leave a system vulnerable to Pass the Hash attacks. This use case detects registry
  modification events or process executions with registry modification commands targeting
  LocalAccountTokenFilterPolicy.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(EventCode=4103)
  OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<")) "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  "LocalAccountTokenFilterPolicy" ("Set-Item-Property" OR "sp " OR "ADD") | table
  _time, host, user, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:modify registry
- defense-evasion:use alternate authentication material:pass the hash
technique_id:
- T1112
- T1550.002
data_category:
- PowerShell logs
references:
- https://www.security.com/threat-intelligence/china-southeast-asia-espionage
- https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
- https://kb.cybertecsecurity.com/knowledge/localaccounttokenfilterpolicy

name: MCP Sensitive System File Search
id: 4a57877d-9c56-4a50-9ad2-620e2f0ad821
version: 3
creation_date: '2026-02-17'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Hunting
description: This detection identifies MCP filesystem tool usage attempting to search for files containing sensitive patterns such as passwords, credentials, API keys, secrets, and configuration files. Adversaries and malicious insiders may abuse legitimate MCP filesystem capabilities to conduct reconnaissance and discover sensitive data stores for exfiltration or credential harvesting.
data_source:
    - MCP Server
search: |
    `mcp_server`
    (method IN ("read_file", "get_file_contents", "read", "search_files", "find_files", "grep", "search", "list_directory", "read_directory"))
    (params.path="*.ssh*" OR params.path="*Administrator*" OR params.path="*credentials*" OR params.path="*password*" OR params.path="*.env*" OR params.path="*id_rsa*" OR params.path="*.pem*" OR params.path="*.ppk*" OR params.path="*.key*" OR params.path="*secrets*" OR params.path="*.aws*" OR params.path="*.config*"
    OR params.pattern="*password*" OR params.pattern="*key*" OR params.pattern="*secret*" OR params.pattern="*credential*" OR params.pattern="*token*" OR params.pattern="*auth*" OR params.pattern="*api_key*" OR params.pattern="*private_key*")
    | eval dest=host
    | eval detection_type=case(
        method IN ("read_file", "get_file_contents", "read"), "PATH_ACCESS",
        method IN ("search_files", "find_files", "grep", "search"), "PATTERN_SEARCH",
        method IN ("list_directory", "read_directory"), "DIRECTORY_ENUM",
        1=1, "UNKNOWN")
    | eval target_path=coalesce('params.path', 'params.directory', 'params.file')
    | eval search_pattern=coalesce('params.pattern', 'params.query', 'params.search')
    | stats count min(_time) as firstTime max(_time) as lastTime values(detection_type) as detection_types values(target_path) as targeted_paths values(search_pattern) as search_patterns values(method) as methods_used by dest, source
    | eval time_span_seconds=lastTime-firstTime
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table dest firstTime lastTime count source detection_types methods_used targeted_paths search_patterns time_span_seconds
    | `mcp_sensitive_system_file_search_filter`
how_to_implement: This detection requires the MCP Technology Add-on (TA) for Splunk, which ingests logs from MCP-enabled AI coding assistants and agents. Configure the TA to collect events from MCP servers by pointing it to the appropriate log sources (typically JSON-formatted logs from tools like Claude Code, Cursor, or custom MCP implementations). The TA should normalize file search operations into the search_files method with standardized parameter extraction.
known_false_positives: Known false positives include legitimate development activities where developers search for configuration files, environment variables, or authentication modules as part of normal coding tasks, as well as security audits involving authorized security reviews or code scanning tools searching for hardcoded secrets. Additionally, documentation lookups for example config files or authentication documentation may trigger this detection, along with refactoring tasks where developers rename or consolidate credential management code across a codebase, and onboarding activities where new developers explore unfamiliar codebases to understand authentication flows.
references:
    - https://splunkbase.splunk.com/app/8377
    - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
analytic_story:
    - Suspicious MCP Activities
asset_type: Web Application
mitre_attack_id:
    - T1552.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Microsoft Intune Bulk Wipe
id: c3f48aa9-878e-443f-8889-e42a11a9bea9
version: 2
creation_date: '2026-04-15'
modification_date: '2026-05-13'
author: Jake Enea
status: production
type: TTP
description: |-
    The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default).
    It leverages Intune audit logs to identify when this action is triggered. This activity is significant beacuse the "wipe ManagedDevice" action factory resets devices connected to your Microsoft Intune tenant.
    If confirmed malicious, an attacker can abuse this action to perform a large-scale data wiping attack against your managed endpoints.
data_source:
    - Azure Monitor Activity
search: |-
    `azure_monitor_activity`
    operationName="wipe ManagedDevice"
    | rename identity as user
             resultType as result
    | fillnull
    | table _time action command dest user src
            vendor_account vendor_product change_type
            properties.Targets.*

    | stats min(_time) as firstTime
            max(_time) as lastTime
            values(*) as *
      count by user

    | where count >= 5
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `microsoft_intune_bulk_wipe_filter`
how_to_implement: |-
    The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest Intune audit logs via Azure EventHub.
    To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
    Deploy as an event-based detection rule for quick deployment.
    Adjust the count threshold according to expected activity in your environment.
known_false_positives: |-
    Legitimate adminstrative usage of the "wipe ManagedDevice" action might trigger this detection.
    This action is typically used for offboarding endpoints or in response to a lost or stolen device.
references:
    - https://www.lumos.com/blog/stryker-hack
    - https://www.covertswarm.com/post/swarm-intelligence-strykers-intune-wipe-proves-your-bcdr-plan-has-a-single-point-of-failure
    - https://www.wwt.com/blog/how-the-stryker-intune-wipe-incident-highlights-a-critical-gap-in-endpoint-control
finding:
    title: Bulk wipe action executed by user $user$ on $dest$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1561.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '5697.5959'
title: Multiple Host logons
description: 'Use case looks for users who have logged into multiple hosts. -- Threat
  Actor Association: CL-STA-0043'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "<EventID>4624<") | regex user!="(?i)system|ANONYMOUS\sLOGON|DefaultAppPool|IUSR|(LOCAL|network)\sSERVICE|\$$"
  | table _time, host, user, process, process_*, parent_* | bin span=86400s | stats
  values(*) as * by _time, user | eventstats dc(host) as dc_host by user, _time |
  where dc_host > 2 '
techniques:
- defense-evasion:valid accounts
technique_id: 
- T1078
data_category:
- Windows event logs
references:
- https://www.cadosecurity.com/post/responding-to-solarigate

name: Processes Tapping Keyboard Events
id: 2a371608-331d-4034-ae2c-21dda8f1d0ec
version: 12
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Jose Hernandez, Splunk
status: experimental
type: TTP
description: The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
data_source:
    - Osquery Results
search: |-
    | from datamodel Alerts.Alerts
    | search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps
    | rename columns.cmdline as cmd, columns.name as process_name, columns.pid as process_id
    | dedup host,process_name
    | table host,process_name, cmd, process_id
    | `processes_tapping_keyboard_events_filter`
how_to_implement: In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model.
known_false_positives: There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.
references: []
finding:
    title: Keyboard Event Tapping observed on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - ColdRoot MacOS RAT
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: threat

name: ServicePrincipalNames Discovery with PowerShell
id: 13243068-2d38-11ec-8908-acde48001122
version: 13
creation_date: '2021-10-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of `powershell.exe` to query the domain for Service Principal Names (SPNs) using Script Block Logging EventCode 4104. It identifies the use of the KerberosRequestorSecurityToken class within the script block, which is equivalent to using setspn.exe. This activity is significant as it often precedes kerberoasting or silver ticket attacks, which can lead to credential theft. If confirmed malicious, attackers could leverage this information to escalate privileges or persist within the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `serviceprincipalnames_discovery_with_powershell_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives should be limited, however filter as needed.
references:
    - https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
    - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
    - https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html
    - https://attack.mitre.org/techniques/T1558/003/
    - https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx
    - https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
    - https://blog.zsec.uk/paving-2-da-wholeset/
    - https://msitpros.com/?p=3113
    - https://adsecurity.org/?p=3466
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
finding:
    title: An instance of attempting to identify service principle detected on $dest$ names.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of attempting to identify service principle detected on $dest$ names.
analytic_story:
    - Hellcat Ransomware
    - Active Directory Discovery
    - Active Directory Kerberos Attacks
    - Malicious PowerShell
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1558.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Verclsid CLSID Execution
id: 61e9a56a-20fa-11ec-8ba3-acde48001122
version: 9
creation_date: '2021-09-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the potential abuse of the verclsid.exe utility to execute malicious files via generated CLSIDs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with verclsid.exe. This activity is significant because verclsid.exe is a legitimate Windows application used to verify CLSID COM objects, and its misuse can indicate an attempt to bypass security controls. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, potentially leading to system compromise or further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` values(Processes.process) as process
    values(Processes.parent_process) as parent_process values(Processes.process_id)
    as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
    (Processes.process_name="verclsid.exe" OR Processes.original_file_name="verclsid.exe")
    Processes.process="*/S*"
    Processes.process="*/C*"
    Processes.process="*{*"
    Processes.process="*}*"
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
       Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `verclsid_clsid_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: windows can used this application for its normal COM object validation.
references:
    - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
    - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
analytic_story:
    - Unusual Processes
asset_type: Endpoint
mitre_attack_id:
    - T1218.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Office Product Loaded MSHTML Module
id: 4cc015c9-687c-40d2-adcc-46350f66e10c
version: 7
creation_date: '2021-09-09'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: Limited false positives will be present, however, tune as necessary. Some applications may legitimately load mshtml.dll.
references:
    - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
    - https://strontic.github.io/xcyclopedia/index-dll
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Spearphishing Attachments
    - Microsoft MSHTML Remote Code Execution CVE-2021-40444
    - CVE-2023-36884 Office and Windows HTML RCE Vulnerability
    - MuddyWater
asset_type: Endpoint
cve:
    - CVE-2021-40444
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows RDP Cache File Deletion
id: f3e86ff3-b1f9-4382-8924-6913385f1019
version: 5
creation_date: '2025-08-06'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory.
    These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance.
    Deleting these files may indicate an attempt to remove forensic evidence of RDP usage.
    While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access.
    When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: |-
    `sysmon`
    EventCode IN (23, 26)
    TargetFilename IN (
        "*\\Terminal Server Client\\Cache\\*.bmc",
        "*\\Terminal Server Client\\Cache\\cache*.bin"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

      by action dest dvc file_path file_hash file_name
         file_modify_time process_exec process_guid process_id
         process_name process_path signature
         signature_id user user_id vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rdp_cache_file_deletion_filter`
how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
references:
    - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
    - https://thelocalh0st.github.io/posts/rdp/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a file related to rdp connection cached has been deleted on $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Snake Malware File Modification Crmlog
id: 27187e0e-c221-471d-a7bd-04f698985ff6
version: 9
creation_date: '2023-05-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This detection leverages the Endpoint.Filesystem datamodel to monitor file creation events in the specified directory. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
data_source:
    - Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" AND  Filesystem.file_name="*.crmlog" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_snake_malware_file_modification_crmlog_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme.
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
finding:
    title: A file related to Snake Malware has been identified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Snake Malware
asset_type: Endpoint
atomic_guid:
    - 7e47ee60-9dd1-4269-9c4f-97953b183268
mitre_attack_id:
    - T1027
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Zscaler Scam Destinations Threat Blocked
id: a0c21379-f4ba-4bac-a958-897e260f964a
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Rod Soto, Splunk
status: production
type: Anomaly
description: The following analytic identifies blocked scam-related activities detected by Zscaler within a network. It leverages web proxy logs to examine actions flagged as scam threats, focusing on data points such as device owner, user, URL category, destination URL, and IP. This detection is significant for SOC as it helps in the early identification and mitigation of scam activities, ensuring network safety. If confirmed malicious, this activity could indicate attempts to deceive users, potentially leading to data theft or financial loss.
data_source: []
search: |-
    `zscaler_proxy` action=blocked threatname=*scam*
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action deviceowner user
           urlcategory url src
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `zscaler_scam_destinations_threat_blocked_filter`
how_to_implement: You must install the latest version of Zscaler Add-on from Splunkbase. You must be ingesting Zscaler events into your Splunk environment through an ingester. This analytic was written to be used with the "zscalernss-web" sourcetype leveraging the Zscaler proxy data. This enables the integration with Splunk Enterprise Security. Security teams are encouraged to adjust the detection parameters, ensuring the detection is tailored to their specific environment.
known_false_positives: False positives are limited to Zscaler configuration.
references:
    - https://help.zscaler.com/zia/nss-feed-output-format-web-logs
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Potential Scam Threat from dest -[$dest$] on $src$ for user-[$user$].
        - field: user
          type: user
          score: 20
          message: Potential Scam Threat from dest -[$dest$] on $src$ for user-[$user$].
threat_objects:
    - field: url
      type: url
analytic_story:
    - Zscaler Browser Proxy Threats
asset_type: Web Server
mitre_attack_id:
    - T1566
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: threat