Splunk rules: 2z

name: Bcdedit Command Back To Normal Mode Boot
id: dc7a8004-0f18-11ec-8c54-acde48001122
version: 12
creation_date: '2021-09-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. This detection leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions involving `bcdedit.exe` with specific parameters. This activity is significant as it may indicate the presence of ransomware, such as BlackMatter, which manipulates boot configurations to facilitate encryption processes. If confirmed malicious, this behavior could allow attackers to maintain control over the boot process, potentially leading to further system compromise and data encryption.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = bcdedit.exe Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `bcdedit_command_back_to_normal_mode_boot_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
finding:
    title: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
analytic_story:
    - Black Basta Ransomware
    - BlackMatter Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1490
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Cisco Isovalent - Nsenter Usage in Kubernetes Pod
id: cd07120d-4265-481a-ba0f-3b91fbc5a02f
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
    This analytic detects the execution of the nsenter utility from within a container, a technique often used for exploitation and container escape. Nsenter allows an attacker to enter the namespaces of another process—such as the host's init process (PID 1)—and execute a shell or other binaries with elevated privileges. For example, an attacker may use docker exec to gain a shell in a container, enumerate the PID of a target container or the host, and then use nsenter to access all namespaces (mount, UTS, IPC, net, pid) of the host or another container.  Example to escape to the host: `nsenter --target 1 --mount --uts --ipc --net --pid -- bash`. The WorkloadAncestorsBinary field is used to track the ancestry of the process, this is useful to understand the context of the nsenter usage.

    The options -m -u -n -i -p correspond to the various Linux namespaces. Adversaries exploit nsenter when pods are misconfigured with excessive privileges (e.g., privileged, hostPID, or broad hostPath mounts), enabling them to interact with the underlying node filesystem and processes. This can be an indicator of a container escape attempt or privilege escalation. Security teams should pay close attention to any nsenter invocation from within containers, especially outside of normal maintenance activity or in workloads with elevated privileges.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec` process_name="nsenter"
    | eval WorkloadAncestorsBinary=mvjoin(parent_process_name, " <- ")
    | stats count
            min(_time) as firstTime
            max(_time) as lastTime
            values(process) as process
            values(WorkloadAncestorsBinary) as WorkloadAncestorsBinary
        by cluster_name container_id pod_name pod_namespace pod_image_name parent_process_name process_name process_exec process_id node_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___nsenter_usage_in_kubernetes_pod_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: It is highly unlikely that nsenter will be used in a legitimate way, investigate the alert in context to rule out benign operations.
references:
    - https://isovalent.com/blog/post/2021-11-container-escape/
    - https://kubehound.io/reference/attacks/CE_NSENTER/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: An nsenter escape attempt has been detected by user on container pod - [$pod_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Crowdstrike User with Duplicate Password
id: 386dd914-16e5-400b-9bf6-25572cc4415a
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects CrowdStrike alerts for non-admin accounts with duplicate password risk, identifying instances where multiple non-admin users share the same password. This practice weakens security and increases the potential for unauthorized access. Addressing these alerts is essential to ensure each user account has a unique, strong password, thereby enhancing overall security and protecting sensitive information.
data_source: []
search: |-
    `crowdstrike_identities` primaryDisplayName != "*admin*"
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | where risk_type = "DUPLICATE_PASSWORD"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_user_with_duplicate_password_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User with Duplicate Password found on $domain$
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '11170.15434'
title: 'CVE-2022-30190: Microsoft Office Code Execution Vulnerability'
description: 'Aka: Follina. A remote code execution vulnerability exists when MSDT
  is called using the URL protocol from a calling application such as Word. An attacker
  who successfully exploits this vulnerability can run arbitrary code with the privileges
  of the calling application. The attacker can then install programs, view, change,
  or delete data, or create new accounts in the context allowed by the user’s rights.
  - Threat Actor Association: APT28, GoldenJackal, RomCom, TA413 - Software Association:
  CrescentImp, Qakbot/Qbot'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("msdt.exe" OR TERM(msdt)) (("PCWDiagnostic" and
  ("ms-msdt:-id" OR "ms-msdt:/id")) OR "invoke" OR (TERM(Microsoft) TERM(Office))
  OR TERM(WINWORD.EXE) OR TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE) OR TERM(MSACCESS.EXE)
  OR TERM(OUTLOOK.EXE) OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE) OR TERM(wordpad.exe))
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | where (match(process, "(?i)PCWDiagnostic|invoke")
  OR match(parent_process_path, "(?i)(Microsoft Office)|(WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)"))
  and match(process_name, "(?i)msdt.exe") '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

name: Detect hosts connecting to dynamic domain providers
id: a1e761ac-1344-4dbd-88b2-3f34c912d359
version: 13
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
data_source:
    - Sysmon EventID 22
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime
      from datamodel=Network_Resolution where
      DNS.query=*
      NOT DNS.query IN ("-", "unknown")
      by DNS.answer DNS.answer_count DNS.query DNS.query_count
         DNS.reply_code_id DNS.src DNS.vendor_product
    | `drop_dm_object_name("DNS")`
    | `security_content_ctime(firstTime)`
    | lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default
    | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local
    | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default)
    |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
    | `detect_hosts_connecting_to_dynamic_domain_providers_filter`
how_to_implement: "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the `Network_Resolution` data model. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces fields (query, answer, isDynDNS) that are not yet supported by Mission Control Queue and therefore cannot be viewed when a finding is raised. These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Mission Control Queue. Event Attributes (Configure > Findings and Investigations > Add New field):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\n"
known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.
references: []
finding:
    title: A dns query $query$ from your infra connecting to suspicious domain
    entity:
        field: src
        type: system
        score: 50
analytic_story:
    - Data Protection
    - Prohibited Traffic Allowed or Protocol Mismatch
    - DNS Hijacking
    - Suspicious DNS Traffic
    - Dynamic DNS
    - Command And Control
asset_type: Endpoint
mitre_attack_id:
    - T1189
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Detect MSHTA Url in Command Line
id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
version: 21
creation_date: '2020-04-29'
modification_date: '2026-07-20'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of Microsoft HTML Application Host (mshta.exe) to make remote HTTP or HTTPS connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments containing URLs. This activity is significant because adversaries often use mshta.exe to download and execute remote .hta files, bypassing security controls. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network infiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_mshta` (Processes.process="*http://*"
        OR
        Processes.process="*https://*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_mshta_url_in_command_line_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible legitimate applications may perform this behavior and will need to be filtered.
references:
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
    - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
    - https://denwp.com/dissecting-lumma-malware/
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to access a remote destination to download an additional payload.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to access a remote destination to download an additional payload.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - Compromised Windows Host
    - Lumma Stealer
    - Living Off The Land
    - Suspicious MSHTA Activity
    - XWorm
    - Cisco Network Visibility Module Analytics
    - NetSupport RMM Tool Abuse
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Remote Access Software Usage File
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
version: 16
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: |
    The following analytic detects the writing of files from known remote access software to disk within the environment.
    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information.
    This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
    If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems.
    It is best to update both the remote_access_software_usage_exception.csv lookup and the remote_access_software lookup with any known or approved remote access software to reduce false positives and increase coverage.
    In order to enhance performance, the detection filters for specific file names extensions / names that are used in the remote_access_software lookup.
    If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime,
            max(_time) as lastTime
            values(Filesystem.file_path) as file_path
    from datamodel=Endpoint.Filesystem
    where Filesystem.file_name IN (
      "*.app",
      "*.exe",
      "*.msi",
      "*.pkg",
      "*echoware.dll",
      "*Idrive.*",
      "*rdp2tcp.py"
    )
    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
       Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name(Filesystem)`
    | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category
    | search isutility = TRUE
    | `remote_access_software_usage_exceptions`
    | `detect_remote_access_software_usage_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
        - field: user
          type: user
          score: 20
          message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
threat_objects:
    - field: file_name
      type: file_name
    - field: signature
      type: signature
analytic_story:
    - Cactus Ransomware
    - CISA AA24-241A
    - Command And Control
    - GhostRedirector IIS Module and Rungan Backdoor
    - Gozi Malware
    - Insider Threat
    - Interlock Ransomware
    - Ransomware
    - Remote Monitoring and Management Software
    - Scattered Lapsus$ Hunters
    - Scattered Spider
    - Seashell Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1124.1202'
title: File Modified for Execution
description: 'Detect when a file has been modified to an executable file with chmod.
  -- Threat Actor Association: APT41, Mélofée, TeamTNT, UNC5221, UTA0178, WatchDog,
  Winnti Group - Software Association: Ransom Cartel -- Atomics T1059.004 Test#1 Atomics
  T1222.002 Test#1 Atomics T1222.002 Test#2 Atomics T1222.002 Test#3 Atomics T1222.002
  Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` TERM(type=EXECVE) TERM(CHMOD)
  | regex process="(?i)(^chmod\s+([-fhvrlp]+\s+)?((([01234567]{1,1})?([1357]{1,1})[01234567]{1,2}|([01234567]{1,1})[1357]{1,1}([01234567]{1,1})|([01234567]{1,2})[1357]{1,1})|[xs\+ugota\,]+)(\s+)[^\s]+)"
  | rex field=process "(?i)(^chmod\s+([-fhvrlp]+\s+)?((([01234567]{1,1})?([1357]{1,1})[01234567]{1,2}|([01234567]{1,1})[1357]{1,1}([01234567]{1,1})|([01234567]{1,2})[1357]{1,1})|[xs\+ugota\,]+)(\s+))(?<process_params>.+)"
  | rex field=process_params max_match=10 "(?i)(?<file_path>[^\s]+)" | table _time,
  host, user process, file_path, process_* | bin span=1s | stats values(*) as * by
  _time, host, process | eventstats dc(host) as dc_host by process| eventstats count
  as c_process by process| where dc_host=1 and c_process<10 '
techniques:
- execution:command and scripting interpreter:unix shell
- privilege-escalation:abuse elevation control mechanism:setuid and setgid
- defense-evasion:file and directory permissions modification:linux and mac file and
  directory permissions modification
technique_id:
- T1548.001
- T1222.002
- T1059.004
data_category:
- Process command-line parameters
- Linux audit logs
references: null

name: GitHub Enterprise Repository Deleted
id: f709e736-3e6c-492f-b865-bc7696cc24a7
version: 8
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user deletes a repository in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for repository deletion events, which could indicate unauthorized removal of critical source code and project resources. For a SOC, identifying repository deletions is crucial as it may signal account compromise, insider threats, or malicious attempts to destroy intellectual property and disrupt development operations. The impact could be severe, potentially resulting in permanent loss of source code, documentation, project history, and other critical assets if proper backups are not maintained. Repository deletion could halt development workflows, cause significant business disruption, and require substantial effort to restore from backups if available. Additionally, unauthorized repository removal could be part of a larger attack campaign aimed at destroying or compromising enterprise assets.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=repo.destroy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_is_bot,
           actor_location.country_code, business, business_id,
           org, org_id, repo,
           repo_id, user_agent, visibility,
           action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_repository_deleted_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ deleted a repository in GitHub Enterprise
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1485
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Internal Horizontal Port Scan
id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1
version: 14
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
data_source:
    - AWS CloudWatchLogs VPCflow
    - Cisco Secure Firewall Threat Defense Connection Event
search: |-
    | tstats `security_content_summariesonly` values(All_Traffic.action) as action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port) as src_port count FROM datamodel=Network_Traffic
      WHERE All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
      BY All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip
         All_Traffic.transport All_Traffic.rule span=1s
         _time
    | `drop_dm_object_name("All_Traffic")`
    | eval gtime=_time
    | bin span=1h gtime
    | stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone
      BY src_ip dest_port gtime
         transport
    | where totalDestIPCount>=250
    | eval dest_port=transport + "/" + dest_port
    | stats min(_time) as _time values(action) as action sum(totalDestIPCount) as totalDestIPCount values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone) as src_zone
      BY src_ip gtime
    | fields - gtime
    | `internal_horizontal_port_scan_filter`
how_to_implement: To properly run this search, Splunk needs to ingest data from networking telemetry sources such as firewalls, NetFlow, or host-based networking events. Ensure that the Network_Traffic data model is populated to enable this search effectively.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: $src_ip$ has scanned for ports $dest_ports$ across $totalDestIPCount$ destination IPs
    entity:
        field: dest_ports
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Network Discovery
    - Cisco Secure Firewall Threat Defense Analytics
    - China-Nexus Threat Activity
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Auditd Osquery Service Stop
id: 0c320fea-6e87-4b99-a884-74d09d4b655d
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious stopping of the `osquery` service, which may indicate an attempt to disable monitoring and evade detection. `Osquery` is a powerful tool used for querying system information and detecting anomalies, and stopping its service can be a sign that an attacker is trying to disrupt security monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops of the `osquery` service, this analytic helps identify potential efforts to bypass security controls, enabling security teams to investigate and respond to possible threats effectively.
data_source:
    - Linux Auditd Service Stop
search: |-
    `linux_auditd` type=SERVICE_STOP unit IN ("osqueryd")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type pid comm
           exe unit dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_osquery_service_stop_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux c99 Privilege Escalation
id: e1c6dec5-2249-442d-a1f9-99a4bd228183
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the c99 utility with sudo privileges, which can lead to privilege escalation on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential misuse of the c99 utility to gain root access, which is critical for maintaining system security. If confirmed malicious, this could allow an attacker to execute commands as root, potentially compromising the entire system and accessing sensitive information.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*c99*"
        AND
        Processes.process="*-wrapper*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_c99_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/c99/
    - https://pubs.opengroup.org/onlinepubs/009604499/utilities/c99.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Okta New API Token Created
id: c3d22720-35d3-4da4-bd0a-740d37192bd4
version: 14
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
data_source:
    - Okta
search: |-
    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
      WHERE All_Changes.action=created
        AND
        All_Changes.command=system.api_token.create
      BY _time span=5m All_Changes.user
         All_Changes.result All_Changes.command sourcetype
         All_Changes.src All_Changes.action All_Changes.object_category
         All_Changes.dest
    | `drop_dm_object_name("All_Changes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `okta_new_api_token_created_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
references:
    - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
    - https://splunkbase.splunk.com/app/6553
finding:
    title: A new API token was created in Okta by [$user$]. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1078.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

name: Powershell Remove Windows Defender Directory
id: adf47620-79fa-11ec-b248-acde48001122
version: 17
creation_date: '2022-01-20'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory.
    It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path.
    This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component.
    If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText = "*rmdir *"
    ScriptBlockText = "*\\Microsoft\\Windows Defender*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id user_id
         vendor_product EventID Guid Opcode
         Name Path ProcessID
         ScriptBlockId ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_remove_windows_defender_directory_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$
analytic_story:
    - Data Destruction
    - WhisperGate
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ProxyShell ProxyNotShell Behavior Detected
id: c32fab32-6aaf-492d-bfaf-acbed8e50cdf
version: 10
creation_date: '2022-10-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Correlation
description: The following analytic identifies potential exploitation of Windows Exchange servers via ProxyShell or ProxyNotShell vulnerabilities, followed by post-exploitation activities such as running nltest, Cobalt Strike, Mimikatz, and adding new users. It leverages data from multiple analytic stories, requiring at least five distinct sources to trigger, thus reducing noise. This activity is significant as it indicates a high likelihood of an active compromise, potentially leading to unauthorized access, privilege escalation, and persistent threats within the environment. If confirmed malicious, attackers could gain control over the Exchange server, exfiltrate data, and maintain long-term access.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.analyticstories) as analyticstories values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count dc(All_Risk.analyticstories) as dc_analyticstories FROM datamodel=Risk.All_Risk
      WHERE All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell")
        OR
        (All_Risk.analyticstories IN ("ProxyNotShell","ProxyShell")
        AND
        All_Risk.analyticstories="Cobalt Strike") All_Risk.risk_object_type="system"
      BY _time span=1h All_Risk.risk_object
         All_Risk.risk_object_type
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >=5
    | `proxyshell_proxynotshell_behavior_detected_filter`
how_to_implement: To implement this correlation, you will need to enable ProxyShell, ProxyNotShell and Cobalt Strike analytic stories (the anaytics themselves) and ensure proper data is being collected for Web and Endpoint datamodels. Run the correlation rule seperately to validate it is not triggering too much or generating incorrectly. Validate by running ProxyShell POC code and Cobalt Strike behavior.
known_false_positives: False positives will be limited, however tune or modify the query as needed.
references:
    - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
    - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
finding:
    title: ProxyShell/ProxyNotShell Behavior Detected - $risk_object$
    entity:
        field: risk_object
        type: other
        score: 0
analytic_story:
    - ProxyShell
    - ProxyNotShell
    - Seashell Blizzard
asset_type: Web Server
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Short Lived Windows Accounts
id: b25f6f62-0782-43c1-b403-083231ffd97d
version: 14
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the rapid creation and deletion of Windows accounts within a short time frame of 1 hour. It leverages the "Change" data model in Splunk, specifically monitoring events with result IDs 4720 (account creation) and 4726 (account deletion). This behavior is significant as it may indicate an attacker attempting to create and remove accounts quickly to evade detection or gain unauthorized access. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further malicious actions within the environment. Immediate investigation of flagged events is crucial to mitigate potential damage.
data_source:
    - Windows Event Log System 4720
    - Windows Event Log System 4726
search: |-
    | tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change
      WHERE All_Changes.result_id=4720
        OR
        All_Changes.result_id=4726
      BY _time span=1h All_Changes.user
         All_Changes.dest All_Changes.Account_Management.src All_Changes.Account_Management.src_user
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `drop_dm_object_name("All_Changes")`
    | `drop_dm_object_name("Account_Management")`
    | transaction user connected=false maxspan=60m
    | eval create_result_id=mvindex(result_id, 0)
    | eval delete_result_id=mvindex(result_id, 1)
    | search create_result_id = 4720 delete_result_id=4726
    | table firstTime lastTime count user src src_user dest create_result_id delete_result_id
    | `short_lived_windows_accounts_filter`
how_to_implement: 'This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/. We also recommend adjsuting the maxspan and _time parameter to better fit your environment.'
known_false_positives: It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.
references:
    - https://www.youtube.com/watch?v=D4Cd-KK4ctk
    - https://attack.mitre.org/techniques/T1078/
finding:
    title: A user account $user$ is created and deleted within a short time period on host $dest$ by user $src_user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A user account $user$ is created and deleted within a short time period on host $dest$ by user $src_user$
analytic_story:
    - Active Directory Lateral Movement
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Windows
mitre_attack_id:
    - T1078.003
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

id: '6012.6415'
title: Suspicious Login Failures
description: 'Adversaries may use a single or small list of commonly used passwords
  against the same account in order to acquire valid account credentials. This use
  case looks for multiple logon failures by user and host, which may indicate a brute
  force attack. -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus,
  UNC3944), Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
  | table _time, host, user parent_*, process, process_*, signature_id | bin span=60s
  | stats values(*) as * by _time, host, user |where event_count > 2 '
techniques:
- credential-access:brute force:password guessing
technique_id:
- T1110.001
data_category:
- Windows event logs
references: null

name: Wermgr Process Spawned CMD Or Powershell Process
id: e8fc95bc-a107-11eb-a978-acde48001122
version: 12
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the spawning of cmd or PowerShell processes by the wermgr.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process telemetry, including parent-child process relationships and command-line executions. This behavior is significant as it is commonly associated with code injection techniques used by malware like TrickBot to execute shellcode or malicious DLL modules. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name = "wermgr.exe" `process_cmd`
        OR
        `process_powershell`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `wermgr_process_spawned_cmd_or_powershell_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: Wermgr.exe spawning suspicious processes on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Trickbot
    - Qakbot
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AD Privileged Group Modification
id: 187bf937-c436-4c65-bbcb-7539ffe02da1
version: 11
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: |
    This detection identifies when users are added to privileged Active Directory
    groups by leveraging the Windows Security Event Code 4728 along with a lookup
    of privileged AD groups provided by Splunk Enterprise Security.
    Attackers often add user accounts to privileged AD groups to escalate privileges
    or maintain persistence within an Active Directory environment.
    Monitoring for modifications to privileged groups can help identify potential security breaches
    and unauthorized access attempts.
data_source:
    - Windows Event Log Security 4728
search: |-
    `wineventlog_security` EventCode IN (4728)
      | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc
        BY signature, Group_Name,src_user dest
      | lookup admon_groups_def  cn as Group_Name OUTPUT category
      | where category="privileged"
      | `windows_ad_privileged_group_modification_filter`
how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details.
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/6853
finding:
    title: $user$ was added to privileged AD Group $Group_Name$ by $src_user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: identity