Splunk rules: 2x

name: Cisco Privileged Account Creation with HTTP Command Execution
id: 2c9d4f5a-8b6e-4c7f-9d8e-1a2b3c4d5e6f
version: 4
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Correlation
description: |
    This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`.
    APT actors have been observed creating privileged accounts and then running commands on routers via HTTP GET or POST requests that target privileged execution paths.
    These requests allow attackers to execute commands with the highest privilege level (15) on Cisco devices without requiring interactive SSH access.
    This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and "Privileged Command Execution via HTTP" Snort detections fire for the same network device.
    This behavior indicates an attacker leveraging the newly created account to execute commands remotely via HTTP.
data_source: []
search: |
    | tstats `security_content_summariesonly`
      min(_time) as firstTime
      max(_time) as lastTime
      sum(All_Risk.calculated_risk_score) as risk_score
      count(All_Risk.calculated_risk_score) as risk_event_count

      values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id
      dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count

      values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id
      dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count

      values(All_Risk.tag) as tag
      values(source) as source
      dc(source) as source_count

      values(contributing_events_search)

      values(All_Risk.threat_object)

      from datamodel=Risk.All_Risk where

      source IN (
        "*Cisco IOS Suspicious Privileged Account Creation*",
        "*Cisco Secure Firewall - Privileged Command Execution via HTTP*"
      )
      by All_Risk.normalized_risk_object
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 2
    | `cisco_privileged_account_creation_with_http_command_execution_filter`
how_to_implement: |
    This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation" and "Cisco Secure Firewall - Privileged Command Execution via HTTP". These detections must be configured to generate risk on the same entity field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.
known_false_positives: |
    No false positives have been identified yet.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
finding:
    title: Cisco Privileged Account Creation with HTTP Command Execution - $risk_object$
    entity:
        field: risk_object
        type: other
        score: 0
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1021.004
    - T1136
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: CrowdStrike Falcon Stream Alerts
id: cb6af2b3-29ab-441c-8d8d-679811c8b014
version: 6
creation_date: '2025-06-02'
modification_date: '2026-05-13'
author: Bryan Pluta, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic is to leverage alerts from CrowdStrike Falcon Event Stream. This query aggregates and summarizes DetectionSummaryEvent and IdpDetectionSummaryEvent alerts from CrowdStrike Falcon Event Stream, providing details such as destination, user, severity, MITRE information, and Crowdstrike id and links. The evals in the search do multiple things to include align the severity, ensure the user, dest, title, description, MITRE fields are set properly, and the drilldowns are defined based on the type of alert. The search is highly dynamic to account for different alert types in which some fields may or may not be populated. Having all these fields properly set ensure the appropriate risk and analyst queue fields are correctly populated.
data_source:
    - CrowdStrike Falcon Stream Alert
search: |
    `crowdstrike_stream` metadata.eventType IN (XdrDetectionSummaryEvent,IdpDetectionSummaryEvent,EppDetectionSummaryEvent)
    | rename event.* as *
    | eval risk_score=case(Severity<20, 0, Severity<40 AND Severity>=20, 25, Severity<60 AND Severity>=40, 100, Severity<80 AND Severity>=60, 250, Severity>=80, 500)
    | eval user=coalesce(lower(SourceAccountName),lower(UserName))
    | eval dest=coalesce(HostNames,SourceEndpointHostName)
    | eval mitre_technique = case(!match(Name, "(NGAV
    |Intel Detection)"), Technique)
    | join type=left mitre_technique
     [| inputlookup append=t mitre_attack_lookup
      | fields mitre_technique mitre_technique_id ]
    | eval annotations.mitre_attack = mitre_technique_id
    | eval drilldown_user = if(NOT isnull(user), if(NOT isnull(SourceAccountName),("event.SourceAccountName=" + $SourceAccountName$),"event.UserName=" + $UserName$ ),"")
    | eval drilldown_dest = if(NOT isnull(dest), if(NOT isnull(SourceEndpointHostName),("event.SourceEndpointHostName=" + $SourceEndpointHostName$ +"*"),"event.HostNames=" + $HostNames$ +"*"),"")
    | eval drilldown_dest2 = if( NOT isnull(dest) AND NOT isnull(IOARuleInstanceID) AND Tactic=="Custom Intelligence", if(NOT isnull(SourceEndpointHostName),("dest=" + $SourceEndpointHostName$ +"*"),"dest=" + $HostNames$ +"*"),"")
    | eval annotations.drilldown_search = if(isnull(IOARuleInstanceID) AND Tactic!="Custom Intelligence", "`crowdstrike_stream` metadata.eventType=" + $metadata.eventType$ + " " + drilldown_user + " " + drilldown_dest, "`crowdstrike_stream` ((metadata.eventType=" + $metadata.eventType$ + " " + drilldown_user + " " + drilldown_dest + ") OR (event_simpleName IN (CustomIOABasicProcessDetectionInfoEvent,CustomIOADomainNameDetectionInfoEvent,CustomIOAFileWrittenDetectionInfoEvent,CustomIOANetworkConnectionDetectionInfoEvent) TemplateInstanceId=" + IOARuleInstanceID + " " + drilldown_dest2 + "))")
    | rename "metadata.eventType" as eventType
    | eval title = case(Name=="NGAV", ("RR - CS - " + Tactic + " - " + Technique),Name=="Intel Detection", ("RR - CS - " + Name),eventType=="IdpDetectionSummaryEvent", ("RR - CS - Identity Protection"),1==1, ("RR - CS - " + Name + " - " + Technique) )
    | eval user_append = if(NOT isnull(user)," by " + user,"")
    | eval dest_append = if(NOT isnull(dest)," on " + dest,"")
    | eval description = case(Name=="NGAV", ("CS " + Tactic + " - " + Technique + ": " + FileName),eventType=="IdpDetectionSummaryEvent", ("CS IdP" + " - " + Name),Name=="Intel Detection", ("CS " + Name + " - " + IOCType + ": " + IOCValue),1==1, (Objective + " - " + DetectDescription) )
    | eval description = description + user_append + dest_append
    | eval gid=id, display_id=FalconHostLink, file_hash=SHA256String, hash=MD5String, signature=IOCValue, ip='NetworkAccesses{}.RemoteAddress', process=CommandLine, pid=ProcessId
    | eval file_name = if(isnull('ExecutablesWritten{}.FileName'), FileName, 'ExecutablesWritten{}.FileName')
    | rename id as detection_id, FalconHostLink as detection_url
    | table _time source detection_id detection_url title risk_score description Severity severity HostNames dest Tactic Technique user UserName Objective Name DetectDescription gid, display_id, mitre_technique annotations.mitre_attack annotations.drilldown_search file_hash hash signature ip process pid file_name
    | `crowdstrike_falcon_stream_alerts_filter`
how_to_implement: In order to properly run this search, you need to ingest alerts data from CrowdStrike Event Stream, specifcally using the CrowdStrike Falcon Event Streams Technical Add-On. This add-on will collect alerts using the CrowdStrike:Event:Streams:JSON sourcetype. You will need to define the `crowdstrike_stream` macro to point to the proper index that contains the CrowdStrike:Event:Streams:JSON sourcetype.
known_false_positives: False positives may vary based on Crowdstrike configuration; monitor and filter out the alerts that are not relevant to your environment.
references:
    - https://www.crowdstrike.com/en-us/resources/guides/crowdstrike-falcon-event-streams-add-on-for-splunk-guide-v3/
    - https://splunkbase.splunk.com/app/5082
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $description$
        - field: user
          type: user
          score: 20
          message: $description$
threat_objects:
    - field: file_hash
      type: file_hash
    - field: file_name
      type: file_name
    - field: hash
      type: file_hash
    - field: ip
      type: ip_address
    - field: process
      type: process_name
    - field: signature
      type: file_hash
analytic_story:
    - Critical Alerts
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5691.6112'
title: Data Staged to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. Data may be kept in separate files or
  combined into one file through techniques such as Archive Collected Data. This use
  case looks for common output commands followed by a potential file extension. --
  Threat Actor Association: Actinium/Gamaredon/Primitive Bear, APT29/Nobelium, APT37,
  Arid Viper/APT C-23, Gorgon Group, Kimsuky, Memento Team, Wizard Spider, WIRTE --
  Software Association: Bazar, Conti, Remcos - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104)| regex
  Message="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}" | table _time, host, user signature_id,
  process, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
technique_id:
- T1074.001
data_category:
- Process command-line parameters
- Linux audit logs
- PowerShell logs
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

name: Detect Regsvcs with No Command Line Arguments
id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
version: 15
creation_date: '2021-02-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects instances of regsvcs.exe running without command line arguments. This behavior typically indicates process injection, where another process manipulates regsvcs.exe. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, IDs, and command-line executions. This activity is significant as it may signal an attempt to evade detection and execute malicious code. If confirmed malicious, the attacker could achieve code execution, potentially leading to privilege escalation, persistence, or access to sensitive information.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime FROM datamodel=Endpoint.Processes where
    (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
    Processes.process IN ("*regsvcs","*regsvcs.exe", "*regsvcs.exe\"")
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
       Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_regsvcs_with_no_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
finding:
    title: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Regsvcs Regasm Activity
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1218.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: DNS Kerberos Coercion
id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3
version: 5
creation_date: '2025-11-18'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: Detects DNS-based Kerberos coercion attacks where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication such as in CVE-2025-33073. This detection leverages suricata looking for specific CREDENTIAL_TARGET_INFORMATION structures in DNS queries.
data_source:
    - Suricata
    - Sysmon EventID 22
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.src) as src values(DNS.dest) as dest FROM datamodel=Network_Resolution
      WHERE DNS.query="*1UWhRC*" DNS.query="*AAAAA*" DNS.query="*YBAAAA*"
      BY DNS.answer DNS.answer_count DNS.query
         DNS.query_count DNS.reply_code_id DNS.src
         DNS.vendor_product
    | `drop_dm_object_name(DNS)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime query count src dest
    | `dns_kerberos_coercion_filter`
how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
known_false_positives: It's unlikely that a DNS entry contains the specific structure used by this attack. Filter as needed for your organization.
references:
    - https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
    - https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
    - https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
finding:
    title: A dns query $query$ with marshalled CREDENTIAL_TARGET_INFORMATION seen from $src$
    entity:
        field: src
        type: system
        score: 50
analytic_story:
    - Compromised Windows Host
    - Suspicious DNS Traffic
    - Local Privilege Escalation With KrbRelayUp
    - Kerberos Coercion with DNS
asset_type: Endpoint
cve:
    - CVE-2025-33073
mitre_attack_id:
    - T1557.001
    - T1187
    - T1071.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Domain Group Discovery With Dsquery
id: f0c9d62f-a232-4edd-b17e-bc409fb133d4
version: 12
creation_date: '2021-08-26'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to query for domain groups. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and command-line arguments. This activity is significant because both Red Teams and adversaries use `dsquery.exe` to enumerate domain groups, gaining situational awareness and facilitating further Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out the domain structure, identify high-value targets, and plan subsequent attacks, potentially leading to privilege escalation or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="dsquery.exe"
        )
        (Processes.process="*group*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `domain_group_discovery_with_dsquery_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1069/002/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Discovery
    - LAMEHUG
asset_type: Endpoint
mitre_attack_id:
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi External Root Login Activity
id: 218bf991-6c63-4c26-a682-6ac1a53ad8f8
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection identifies instances where the ESXi UI is accessed using the root account instead of a delegated administrative user. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*root*" AND Message="*logged in*" | rex field=_raw "root@(?<SrcIpAddr>\d{1,3}(?:\.\d{1,3}){3})" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | search SrcIpAddr != "127.0.0.1" AND SrcIpAddr != 192.168.0.0/16 AND SrcIpAddr != 172.16.0.0/12 AND SrcIpAddr != 10.0.0.0/8 | stats min(_time) as firstTime max(_time) as lastTime count by dest SrcIpAddr | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_external_root_login_activity_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed. Administrators may use the root account for troubleshooting or initial user creation.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Root logged in on ESXi host $dest$ from $SrcIpAddr$.
        - field: SrcIpAddr
          type: system
          score: 20
          message: Root logged in on ESXi host $dest$ from $SrcIpAddr$.
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Gsuite suspicious calendar invite
id: 03cdd68a-34fb-11ec-9bd3-acde48001122
version: 7
creation_date: '2021-10-24'
modification_date: '2026-05-13'
author: Rod Soto, Teoderick Contreras
status: experimental
type: Hunting
description: The following analytic detects suspicious calendar invites sent via GSuite, potentially indicating compromised accounts or malicious internal activity. It leverages GSuite calendar logs, focusing on events where a high volume of invites (over 100) is sent within a 5-minute window. This behavior is significant as it may involve the distribution of malicious links or attachments, posing a security risk. If confirmed malicious, this activity could lead to widespread phishing attacks, unauthorized access, or malware distribution within the organization.
data_source: []
search: |-
    `gsuite_calendar`
      | bin span=5m _time
      | rename parameters.* as *
      | search target_calendar_id!=null email="*yourdomain.com"
      | stats  count values(target_calendar_id) values(event_title) values(event_guest)
        BY email _time
      | where count >100
      | `gsuite_suspicious_calendar_invite_filter`
how_to_implement: In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization.
known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter.
references:
    - https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/
    - https://gcn.com/cybersecurity/2012/09/the-20-most-common-words-in-phishing-attacks/280956/
analytic_story:
    - Spearphishing Attachments
asset_type: GSuite
mitre_attack_id:
    - T1566
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '17974.30261'
title: hh.exe Execution
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. -- Threat Actor Association: APT-K-47/Mysterious Elephant,
  Gamaredon (aka. Armageddon, UAC-0010), Kimsuky -- LOLBAS Atomics T1218.001 Test
  #1 Atomics T1218.001 Test #2 Atomics T1218.001 Test #3 Atomics T1218.001 Test #4
  Atomics T1218.001 Test #5 Atomics T1218.001 Test #6 Atomics T1218.001 Test #7 Atomics
  T1218.001 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(hh) OR TERM(hh.exe)) | where match(process_name,
  "(?i)hh\.exe") OR match(process, "(?i)hh\.exe") | table _time, host, user process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-8---decompile-local-chm-file
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
- https://asec.ahnlab.com/en/51746/

name: Linux Auditd At Application Execution
id: 9f306e0a-1c36-469e-8892-968ca12470dd
version: 10
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (uid IN ("daemon"))
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_at_application_execution_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1053/001/
    - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "at" application.
analytic_story:
    - Scheduled Tasks
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1053.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Deletion of SSL Certificate
id: 839ab790-a60a-4f81-bfb3-02567063f615
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of SSL certificates on a Linux machine. It leverages filesystem event logs to identify when files with extensions .pem or .crt are deleted from the /etc/ssl/certs/ directory. This activity is significant because attackers may delete or modify SSL certificates to disable security features or evade defenses on a compromised system. If confirmed malicious, this behavior could indicate an attempt to disrupt secure communications, evade detection, or execute a destructive payload, potentially leading to significant security breaches and data loss.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_deletion_of_ssl_certificate_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: SSL certificate deleted on host $dest$ by process GUID- $process_guid$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - AcidRain
    - AcidPour
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20685.36865'
title: ngrok Execution - Windows
description: 'Ngrok is a legitimate reverse proxy tool that can create a secure tunnel
  to servers located behind firewalls or on local machines that do not have a public
  IP. Ngrok has been leveraged by threat actors in several campaigns including use
  for lateral movement and data exfiltration. This use case detects process creation
  events for ngrok.exe or command patterns likely to be unique to ngrok in the event
  of a renamed executable. -- Threat Actor Association: Scattered Spider (aka. Muddled
  Libra, Scatter Swine, Starfraud, UNC3944)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") TERM(ngrok) OR (TERM(start) "--all" "--config" ".yml") OR (TERM(tcp)
  ("139" OR "445" OR "3389" OR "5985" OR "5986")) | where match(process, "(?i)(tcp\s+(139|445|3389|5985|5986))|(\.exe\s+|(authtoken\s|start\s+--all))|(start\s.*\s--all\s.*\s--config\s.+\.yml)")
  OR match(process_path, "(?i)ngrok\.exe") | table _time, host, user, signature_id,
  process, process_*, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:protocol tunneling
technique_id: 
- T1572
data_category:
- PowerShell logs
references:
- https://www.logpoint.com/en/blog/a-deep-look-at-the-darkside-ransomware-operators-and-their-affiliates/

id: '5987.6349'
title: Package installation
description: 'Some programming languages, like Python, come with an easy, more or
  less official method of installing dependencies for your projects. These installers
  are usually tied to public code repositories where anyone can freely upload code
  packages for others to use. The intent of this use case is to identify installation
  of packages, with common repositories using pip, gem and npm. Use case will be used
  to with additional threat identifiers to potentially identify Dependency confusion
  style attacks. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") (TERM(npm) OR TERM(pip) OR TERM(gem)) TERM(install) | regex process="(?i)install\s"
  | rex field=process "(?<reqs>(?i)requirements\.txt") | rex field=process "(?<extra>(?i)(\-{2}extra)?\-index\-url(\s+\S+)")
  | rex field=process "(?<source1>(?i)\-{2}source(\s+\S+)") | eval keywords=mvappend(reqs,
  extra, source1) | table _time, host, user, signature_id, process, process_*, parent_*,
  keyword | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows event logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

id: '22594.40844'
title: Potential Sysinternals Tool Execution
description: 'Sysinternals is a widely-used set of utilities for endpoint management,
  troubleshooting, and monitoring and is available for free from Microsoft. While
  not installed by default, it can be considered a LOLBAS due to its ubiquity in enterprise
  environments. Threat actors can abuse these utilities in a variety of ways including
  information gathering, remote command execution, memory dumping, and many more.
  This use case detects command line executions including the accepteula flag. The
  names of individual SysInternal tools have not been included to account for instances
  where the process has been renamed. Allowlisting by process path for known benign
  executables using -accepteula or /accepteula combined with usernames expected to
  use Sysinternals is recommended to reduce false positives. -- Threat Actor Association:
  Cluster Alpha (STAC1248) - Software Association: Fog -- LOLBINS/LOLBAS'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "-accepteula" OR "/accepteula" | regex process="(?i)\s(-|\/)accepteula"
  | table _time, host, user host, process, parent_process_path | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- PowerShell logs
references:
- https://learn.microsoft.com/en-us/sysinternals/

id: '32821.58285'
title: Proxy Execution via Appcert
description: Threat actors may exploit legitimate developer utilities to execute malicious
  payloads by proxy. One such utility is appcert.exe, a command-line tool included
  in the Windows Application Certification Kit, which is typically used to verify
  the compliance of Windows applications with Microsoft's certification standards.
  This use case detects appcert executions with commands to proxy execution of another
  binary. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(appcert) OR "appcert.exe") TERM(test) | regex process!="(?i)\-setupcommandline"|
  regex process="(?i)\stest\s"| rex field=process "(?i)-setuppath\s+(?:\"|'')?(?<proxy_exec>[^\s\"'']+\.exe)(?:\"|'')?"
  | table _time, host, user, process, parent_*, process_*, proxy_exec | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

name: Spike in File Writes
id: fdb0f805-74e4-4539-8c00-618927333aae
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
description: The following analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=created
      BY _time span=1h, Filesystem.dest
    | `drop_dm_object_name(Filesystem)`
    | eventstats max(_time) as maxtime
    | stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), count, null))) as "count" avg(eval(if(_time<relative_time(maxtime, "-1d@d"), count,null))) as avg stdev(eval(if(_time<relative_time(maxtime, "-1d@d"), count, null))) as stdev
      BY "dest"
    | eval upperBound=(avg+stdev*4), isOutlier=if((count > upperBound) AND num_data_samples >=20, 1, 0)
    | search isOutlier=1
    | `spike_in_file_writes_filter`
how_to_implement: In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system.
known_false_positives: It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Spike in File Writes observed on $dest$
analytic_story:
    - SamSam Ransomware
    - Ryuk Ransomware
    - Ransomware
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious Kerberos Service Ticket Request
id: 8b1297bc-6204-11ec-b7c4-acde48001122
version: 12
creation_date: '2021-12-20'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name, potentially indicating an exploitation attempt of CVE-2021-42278 and CVE-2021-42287. This detection leverages Event ID 4769 from Domain Controller and Kerberos events. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller. If confirmed malicious, this could allow an attacker to take control of the domain controller, leading to complete domain compromise and unauthorized access to sensitive information.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769
      | eval isSuspicious = if(lower(ServiceName) = lower(mvindex(split(TargetUserName,"@"),0)),1,0)
      | where isSuspicious = 1
      | rename Computer as dest
      | rename TargetUserName as user
      | table _time, dest, src_ip, user, ServiceName, Error_Code, isSuspicious
      | `suspicious_kerberos_service_ticket_request_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.
references:
    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
finding:
    title: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - sAMAccountName Spoofing and Domain Controller Impersonation
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2021-42287
    - CVE-2021-42278
mitre_attack_id:
    - T1078.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Admon Default Group Policy Object Modified
id: 83458004-db60-4170-857d-8572f16f070b
version: 12
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment.
data_source:
    - Windows Active Directory Admon
search: |-
    `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
      | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
        BY dcName, displayName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_admon_default_group_policy_object_modified_filter`
how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
    - https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
finding:
    title: A default domain group policy was updated on $dcName$
    entity:
        field: dcName
        type: system
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Alternate DataStream - Process Execution
id: 30c32c5c-41fe-45db-84fe-275e4320da3f
version: 13
creation_date: '2024-01-10'
modification_date: '2026-06-04'
author: Steven Dick
status: production
type: TTP
description: The following analytic detects when a process attempts to execute a file from within an NTFS file system alternate data stream. This detection leverages process execution data from sources like Windows process monitoring or Sysmon Event ID 1, focusing on specific processes known for such behavior. This activity is significant because alternate data streams can be used by threat actors to hide malicious code, making it difficult to detect. If confirmed malicious, this could allow an attacker to execute hidden code, potentially leading to unauthorized actions and further compromise of the system.
data_source:
    - Windows Event Log Security 4688
    - Sysmon EventID 1
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime values(Processes.process_current_directory) as directory
    from datamodel=Endpoint.Processes where
    Processes.parent_process_name != "unknown"
    Processes.process_name IN (
        "appvlp.exe",
        "bitsadmin.exe",
        "control.exe",
        "cscript.exe",
        "forfiles.exe",
        "ftp.exe",
        "mavinject.exe",
        "mshta.exe",
        "powershell_ise.exe",
        "powershell.exe",
        "pwsh.exe",
        "regini.exe",
        "regsvr32.exe",
        "rundll32.exe",
        "sc.exe",
        "wmic.exe",
        "wscript.exe"
    )

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | regex process="(\b)\w+(\.\w+)?:\w+(\.\w{2,4})(?!\.)(\b|\s|&)"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_alternate_datastream___process_execution_filter`
how_to_implement: Target environment must ingest process execution data sources such as Windows process monitoring and/or Sysmon EventID 1.
known_false_positives: False positives may be generated by process executions within the commandline, regex has been provided to minimize the possibilty.
references:
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
    - https://car.mitre.org/analytics/CAR-2020-08-001/
    - https://blogs.juniper.net/en-us/threat-research/bitpaymer-ransomware-hides-behind-windows-alternate-data-streams
    - https://blog.netwrix.com/2022/12/16/alternate_data_stream/
finding:
    title: The $process_name$ process was executed by $user$ using data from an NTFS alternate data stream.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The $process_name$ process was executed by $user$ using data from an NTFS alternate data stream.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1564.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint