Splunk rules: 2y

id: '17332.28227'
title: 3CXDesktopApp.exe Execution
description: 'Malicious activity has been detected on March 29, 2023, originating
  from a legitimate and signed binary called 3CXDesktopApp, which is a softphone application
  from 3CX. This malicious activity includes beaconing to infrastructure controlled
  by the attackers, deployment of additional payloads in the second stage, and in
  a few cases, direct interaction by the attackers with the system. - Campaign: SmoothOperator
  - Threat Actor Association: Lazarus Group (aka Labyrinth Chollima)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("3CXDesktopApp.exe" OR "3CX Desktop App") | table
  _time, host, user process, process_*, signature_id, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- initial-access:supply chain compromise
- execution:user execution:malicious file
technique_id:
- T1218
- T1195
- T1204.002
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/

id: '6076.18329'
title: ATBroker.exe Execution
description: Helper binary for Assistive Technology (AT), Executes code defined in
  registry for a new AT. Modifications must be made to the system registry to either
  register or modify an existing Assistive Technology (AT) service entry. Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ("EventCode=4104" OR "<EventID>4104<"
  OR "EventCode=4103" OR "<EventID>4103<") "ATBroker.exe" TERM(/start) | table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- PowerShell logs
references:
- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
- https://oddvar.moe/2018/07/23/another-way-to-get-to-a-system-shell/

id: '29796.53837'
title: AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  the installation of AteraAgent RMM.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=22) OR "<EventID>22<")
  TERM(atera) (TERM(rundll32) OR "rundll32.exe") | table _time, host, user, signature_ID,
  QueryName, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/

name: Azure AD Successful Authentication From Different Ips
id: be6d868d-33b6-4aaa-912e-724fb555b11a
version: 14
creation_date: '2023-01-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects an Azure AD account successfully authenticating from multiple unique IP addresses within a 30-minute window. It leverages Azure AD SignInLogs to identify instances where the same user logs in from different IPs in a short time frame. This behavior is significant as it may indicate compromised credentials being used by an adversary, potentially following a phishing attack. If confirmed malicious, this activity could allow unauthorized access to corporate resources, leading to data breaches or further exploitation within the network.
data_source:
    - Azure Active Directory
search: |-
    `azure_monitor_aad` properties.authenticationDetails{}.succeeded=true category=SignInLogs
      | rename properties.* as *
      | bucket span=30m _time
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime dc(src) AS unique_ips values(dest) as dest values(src) as src
        BY user vendor_account vendor_product
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | where unique_ips > 1
      | `azure_ad_successful_authentication_from_different_ips_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Signin log category.
known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
references:
    - https://attack.mitre.org/techniques/T1110
    - https://attack.mitre.org/techniques/T1110.001
    - https://attack.mitre.org/techniques/T1110.003
finding:
    title: User $user$ has had successful authentication events from more than one unique IP address in the span of 30 minutes.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Compromised User Account
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1110.001
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Isovalent - Curl Execution With Insecure Flags
id: c16c4899-d3f7-461b-92c2-cc0ef5758855
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for curl commands that use the -k or --insecure flags. This behavior is significant for a SOC as it could allow an attacker to bypass SSL/TLS verification, potentially exposing the Kubernetes infrastructure to man-in-the-middle attacks. If confirmed malicious, this activity could lead to data interception, service disruptions, or unauthorized access to sensitive  information.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec`  process_name="curl"
    | regex process="(?i)(?<!\w)-(?:[a-z]*k[a-z]*|-(insecure|proxy-insecure|doh-insecure))"
    | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process
        by cluster_name pod_name parent_process_name process_name process_exec process_id node_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___curl_execution_with_insecure_flags_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
references:
    - https://rawcode7.medium.com/understanding-the-kubernetes-attack-surface-9a48ebcb6bc4
    - https://www.tutorialworks.com/kubernetes-curl/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: A curl execution with insecure flags has been detected on pod_name [$pod_name$] in the cluster [$cluster_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
atomic_guid:
    - 7e2ad0db-1efa-4af2-a77c-bc6e87d7b3f3
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31349.56234'
title: Command Line Utility Added to Accessibility Features
description: 'Adversaries may establish persistence and/or elevate privileges by executing
  malicious content triggered by accessibility features. Windows contains accessibility
  features that may be launched with a key combination before a user has logged in
  (ex: when the user is on the Windows logon screen). An adversary can modify the
  way these programs are launched to get a command prompt or backdoor without logging
  in to the system. This use case detects registry modification commands or events
  adding cmd.exe or PowerShell/pwsh.exe to Accessibility Features registry keys.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=13) OR "<EventID>13<")
  OR (TERM(EventCode=1) OR "<EventID>1<" ) "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image
  File Execution" "Debugger" ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe"
  OR "Narrator.exe" OR "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe") ("cmd.exe"
  OR "powershell.exe" OR "pwsh.exe") | where (match(signature_id, "13") and match(TargetObject,
  "(?i)Debugger") and match(registry_value_name, "(?i)(cmd|pwsh|powershell)\.exe"))
  or (match(signature_id, "1") and match(process, "(?i)Debugger.+\x5c(cmd|pwsh|powershell)\.exe"))|
  table _time, host, user, process, registry_*, parent_process_name, process_name,
  signature_id, TargetObject | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- persistence:event triggered execution:accessibility features
technique_id:
- T1059
- T1546.008
data_category:
- Windows Sysmon
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1546/008/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.008/T1546.008.md#atomic-test-1---attaches-command-prompt-as-a-debugger-to-a-list-of-target-processes
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base

name: Create or delete windows shares using net exe
id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c
version: 18
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_net`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | search process IN ("*share* /delete*", "*share* /REMARK:*", "*share* /CACHE:*")
    | `create_or_delete_windows_shares_using_net_exe_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate.
references:
    - https://attack.mitre.org/techniques/T1070/005/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Hidden Cobra Malware
    - CISA AA22-277A
    - Windows Post-Exploitation
    - Prestige Ransomware
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1070.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Crowdstrike Privilege Escalation For Non-Admin User
id: 69e2860c-0e4b-40ae-9dc4-bf9e3bf2a548
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects CrowdStrike alerts for privilege escalation attempts by non-admin users. These alerts indicate unauthorized efforts by regular users to gain elevated permissions, posing a significant security risk. Detecting and addressing these attempts promptly helps prevent potential breaches and ensures that user privileges remain properly managed, maintaining the integrity of the organization's security protocols.
data_source: []
search: |-
    `crowdstrike_stream` tag=alert
      | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY src_ip, src_host, user,
           description, type, count_alerts,
           severity
      | where LIKE(type,"%Privilege escalation%") AND NOT LIKE(user, "%adm%") AND NOT LIKE(user, "%svc%") AND NOT LIKE(user, "%admin%")
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_privilege_escalation_for_non_admin_user_filter`
how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A Privilege escalation happened in Non-Admin Account in $src_host$
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect SharpHound File Modifications
id: 42b4b438-beed-11eb-ba1d-acde48001122
version: 13
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. It leverages file modification events from the Endpoint.Filesystem data model, focusing on default file naming patterns like `*_BloodHound.zip` and various JSON files. This activity is significant as it indicates potential domain enumeration, which is a precursor to more targeted attacks. If confirmed malicious, an attacker could gain detailed insights into the domain structure, facilitating lateral movement and privilege escalation.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", "*_ous.json", "*_containers.json")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_sharphound_file_modifications_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
references:
    - https://attack.mitre.org/software/S0521/
    - https://thedfirreport.com/?s=bloodhound
    - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
    - https://github.com/BloodHoundAD/SharpHound3
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
finding:
    title: Potential SharpHound file modifications identified on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Potential SharpHound file modifications identified on $dest$
analytic_story:
    - Windows Discovery Techniques
    - Ransomware
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6564.7498'
title: DNX.exe Proxy Execution
description: dnx.exe is a .Net Execution environment file included with .Net. It is
  possible for adversaries to launch unsigned code with dnx.exe. Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "Dnx.EXE" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
technique_id: 
- T1218
data_category:
- Windows event logs
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dnx/
- https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/

name: ESXi Audit Tampering
id: c48a155b-2861-417a-813c-220f5272cf01
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?<full_command>.*)" | rex field=full_command "\[(?<user>.*)]:\s(?<command>.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
references:
    - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
finding:
    title: Audit tampering activity on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1690
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '5746.6024'
title: Executable Process from Suspicious Folder
description: 'Detects the execution of executable process spawned by powershell or
  similar processes from suspicious file locations like temp, appdata, and downloads.
  - Threat Actor Association: Andariel, APT10/menuPass, APT28 (aka.Fancy Bear, Fighting
  Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT34/OilRig, Blind Eagle/APT-C-36,
  Carbanak, Evilnum, FIN7, FIN8, GoldenJackal, Gorgon Group, Kimsuky, Lazarus, Magic
  Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Mustang Panda
  (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA505,
  TA551, UNC2465, Volt Typhoon, WinterVivern/UAC-0114 -- Software Association: Babuk,
  BadHatch, Bazar, Blackbyte, Clop, IcedID, Lockbit, MagicRAT, PowerShortShell, PYSA/Mespinoza,
  SmokedHAM, SolidBit, RATDispenser, Remcos, TA413, TargetCompany, Trickbot, Trigona,
  Yellow Cockatoo/Jupiter Infostealer, Vidar Stealer, WhisperGate - #TrendingThreat
  #Russia #Ukraine - Atomics T1574.001 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<") ("powershell.exe" OR "cmd.exe" OR "services.exe" OR "dllhost.exe"
  OR "rundll32.exe" OR "cscript.exe" OR "wscript.exe" OR "NTDLL.dll") AND ("Temporary
  Internet Files" OR "TEMP" OR "Downloads" OR "Appdata") | regex parent_process_name="((?i)(powershell\.exe)|(cmd\.exe)|(services\.exe)|(dllhost\.exe)|(rundll32\.exe)|(cscript\.exe)|(wscript\.exe)|(NTDLL\.dll))"|
  regex process_path!="(?i)WindowsUpdateLog"| regex process_path="(?i)Temp|Downloads|Appdata"
  | table _time, host, user event_id, parent_*, process_*, process, signature_id |
  bin span=1s | stats values(*) as * by _time, host, process_path '
techniques:
- execution:command and scripting interpreter
- execution:user execution
- execution:command and scripting interpreter:visual basic
- defense-evasion:system binary proxy execution:rundll32
- execution:command and scripting interpreter:javascript
technique_id:
- T1059
- T1204
- T1059.007
- T1218.011
- T1059.005
data_category:
- Windows event logs
references:
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

name: GetWmiObject Ds Computer with PowerShell Script Block
id: 29b99201-723c-4118-847a-db2b3d3fb8ea
version: 11
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). This detection leverages script block text to identify queries targeting domain computers using WMI. Monitoring this activity is crucial as adversaries and Red Teams may use it for Active Directory Discovery and situational awareness. If confirmed malicious, this behavior could allow attackers to map out domain computers, facilitating further attacks such as lateral movement or privilege escalation.
data_source:
    - Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1018/
    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
finding:
    title: Remote system discovery enumeration on $dest$ by $user_id$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1018
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Enterprise Register Self Hosted Runner
id: b27685a2-8826-4123-ab78-2d9d0d419ed0
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic identifies when a self-hosted runner is created in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for actions related to creating new self-hosted runners at the organization or enterprise level. his behavior warrants monitoring because self-hosted runners execute workflow jobs on customer-controlled infrastructure, which could be exploited by attackers to execute malicious code, access sensitive data, or pivot to other systems. While self-hosted runners are a legitimate feature, their creation should be carefully controlled as compromised runners pose significant security risks. The impact includes potential remote code execution, data exfiltration, and lateral movement within the environment if a runner is compromised. SOC teams should investigate unexpected runner creation events to verify they are authorized and properly secured, especially if created by unfamiliar users or in unusual contexts.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=enterprise.register_self_hosted_runner
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           user_agent, action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_register_self_hosted_runner_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ created a self-hosted runner in GitHub Enterprise
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: HTTP Rapid POST with Mixed Status Codes
id: c8c987d6-3a1a-4555-9a52-eea0741b6113
version: 5
creation_date: '2025-10-21'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: This detection identifies rapid-fire POST request attacks where an attacker sends more than 20 POST requests within a 5-second window, potentially attempting to exploit race conditions or overwhelm request handling. The pattern is particularly suspicious when responses vary in size or status codes, indicating successful exploitation attempts or probing for vulnerable endpoints.
data_source:
    - Nginx Access
search: |-
    `nginx_access_logs` http_method="POST"
      | bin _time span=5s
      | rename dest_ip as dest
      | stats count, values(status) as status_codes, values(bytes_out) as bytes_out, values(uri_path) as uris
        BY _time, src_ip, dest,
           http_user_agent
      | where count>20
      | table _time, dest, src_ip, count, status_codes, bytes_out, http_user_agent
      | `http_rapid_post_with_mixed_status_codes_filter`
how_to_implement: This analytic necessitates the collection of web data, which can be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web Server. No additional configuration is required for this analytic.
known_false_positives: False positives may be present if the activity is part of diagnostics or testing. Filter as needed.
references:
    - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
    - https://portswigger.net/research/http1-must-die
    - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
    - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A potential attempt to perform request smuggling against a web server was detected. The source IP is $src_ip$ and the destination is $dest$.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - HTTP Request Smuggling
asset_type: Web Server
mitre_attack_id:
    - T1071.001
    - T1190
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Find Credentials From Password Managers
id: 784241aa-85a5-4782-a503-d071bd3446f9
version: 11
creation_date: '2024-08-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access.
data_source:
    - Linux Auditd Execve
search: |-
    `linux_auditd` execve_command IN ("*find*", "*grep*") AND execve_command IN ("*.kdbx*", "*KeePass*", "*.enforced*", "*.lpdb*", "*.opvault*", "*.agilekeychain*", "*.dashlane*", "*.rfx*", "*passbolt*", "*.spdb*", "*StickyPassword*", "*.walletx*", "*enpass*", "*vault*", "*.kdb*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY argc execve_command dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_find_credentials_from_password_managers_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
    - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
finding:
    title: A [$execve_command$] event occurred on host - [$dest$] to find credentials stored in password managers.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1555.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Possible Access To Credential Files
id: 0419cb7a-57ea-467b-974f-77c303dfe2a3
version: 13
creation_date: '2024-08-19'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
data_source:
    - Linux Auditd Proctitle
search: "`linux_auditd`  proctitle IN (\"*shadow*\", \"*passwd*\") AND proctitle IN (\"*cat *\", \"*nano *\", \"*vim *\", \"*vi *\")\n  | rename host as dest\n  | stats count min(_time) as firstTime max(_time) as lastTime\n    BY proctitle dest\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `linux_auditd_possible_access_to_credential_files_filter`"
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd
    - https://attack.mitre.org/techniques/T1003/008/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to access or dump the contents of /etc/passwd and /etc/shadow files.
analytic_story:
    - Linux Persistence Techniques
    - Compromised Linux Host
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1003.008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Ingress Tool Transfer Hunting
id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
version: 12
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the use of 'curl' and 'wget' commands within a Linux environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, user information, and command-line executions. This activity is significant as 'curl' and 'wget' are commonly used for downloading files, which can indicate potential ingress of malicious tools. If confirmed malicious, this activity could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Monitoring and tuning this detection helps identify and differentiate between normal and potentially harmful usage.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=curl
            OR
            Processes.process_name=wget
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_ingress_tool_transfer_hunting_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics.
references:
    - https://gtfobins.github.io/gtfobins/curl/
    - https://curl.se/docs/manpage.html#-I
    - https://gtfobins.github.io/gtfobins/curl/
    - https://github.com/rapid7/metasploit-framework/search?q=curl
analytic_story:
    - Ingress Tool Transfer
    - Linux Living Off The Land
    - XorDDos
    - NPM Supply Chain Compromise
    - Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Malicious Powershell Executed As A Service
id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
version: 13
creation_date: '2021-04-13'
modification_date: '2026-05-13'
author: Ryan Becwar
status: production
type: TTP
description: The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. It detects this activity by analyzing Windows System logs (EventCode 7045) and filtering for specific PowerShell-related patterns in the ImagePath field. This behavior is significant because it indicates potential abuse of the Windows Service Control Manager to run unauthorized or harmful scripts, which could lead to system compromise. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system`
    EventCode=7045
    | eval l_ImagePath=lower(ImagePath)
    | regex l_ImagePath="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
    | regex l_ImagePath="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
    | stats count min(_time) as firstTime max(_time) as lastTime
        by EventCode ImagePath ServiceName StartType
           ServiceType AccountName UserID dest
    | rename UserID as user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `malicious_powershell_executed_as_a_service_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
known_false_positives: Creating a hidden powershell service is rare and could key off of those instances.
references:
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
    - http://az4n6.blogspot.com/2017/
    - https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
finding:
    title: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $ImagePath$ by $user$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $ImagePath$ by $user$ on $dest$
analytic_story:
    - Compromised Windows Host
    - Rhysida Ransomware
    - Malicious PowerShell
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MS Exchange Mailbox Replication service writing Active Server Pages
id: 985f322c-57a5-11ec-b9ac-acde48001122
version: 8
creation_date: '2021-03-18'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. It detects this activity by monitoring the MSExchangeMailboxReplication.exe process, which typically does not write .aspx files. This behavior is significant as it may indicate an active exploitation attempt on Exchange servers. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, or maintain persistence within the environment. Immediate investigation and remediation are crucial to prevent further compromise.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
references:
    - https://redcanary.com/blog/blackbyte-ransomware/
finding:
    title: A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - ProxyShell
    - Ransomware
    - BlackByte Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1133
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MSBuild Suspicious Spawned By Script Process
id: 213b3148-24ea-11ec-93a2-acde48001122
version: 13
creation_date: '2021-10-04'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the suspicious spawning of MSBuild.exe by Windows Script Host processes (cscript.exe or wscript.exe). This behavior is often associated with malware or adversaries executing malicious MSBuild processes via scripts on compromised hosts. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where MSBuild is a child of script hosts. This activity is significant as it may indicate an attempt to execute malicious code. If confirmed malicious, it could lead to unauthorized code execution, potentially compromising the host and allowing further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name IN ("wscript.exe", "cscript.exe")
        AND
        `process_msbuild`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `msbuild_suspicious_spawned_by_script_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH.
references:
    - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/
finding:
    title: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$
analytic_story:
    - Trusted Developer Utilities Proxy Execution MSBuild
    - Storm-2460 CLFS Zero Day Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1127.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Added Service Principal
id: 1668812a-6047-11eb-ae93-0242ac130002
version: 13
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects the addition of new service principal accounts in O365 tenants. It leverages data from the `o365_management_activity` dataset, specifically monitoring for operations related to adding or creating service principals. This activity is significant because attackers can exploit service principals to gain unauthorized access and perform malicious actions within an organization's environment. If confirmed malicious, this could allow attackers to interact with APIs, access resources, and execute operations on behalf of the organization, potentially leading to data breaches or further compromise.
data_source:
    - O365
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_added_service_principal_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
references:
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
    - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack?hsLang=en
finding:
    title: User $user$ has created new service principal in AzureActiveDirectory
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
    - Cloud Federated Credential Abuse
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1136.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat