Splunk rules: 30

id: '32156.57263'
title: AutoHotkey Execution
description: Adversaries may execute commands and perform malicious tasks using AutoIT
  and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages
  that enable users to automate Windows tasks. These automation scripts can be used
  to perform a wide variety of actions, such as clicking on buttons, entering text,
  and opening and closing programs. This use case detects the usage of the AutoHotkey
  software to execute ahk files.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("AutoHotkey.exe" OR "AutoHotkey.rc" OR "AutoHotkey32.exe"
  OR "AutoHotkey32_UIA.exe" OR "AutoHotkey64.exe" OR "AutoHotkey64_UIA.exe" OR "AutoHotkeyA32.exe"
  OR "AutoHotkeyA32_UIA.exe" OR "AutoHotkeyU32.exe" OR "AutoHotkeyU32_UIA.exe" OR
  "AutoHotkeyU64.exe" OR "AutoHotkeyU64_UIA.exe"OR "AutoHotkeyUX.exe") ".ahk" | table
  _time, host, user, process, parent_process_name, process_name, process_path | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1059/010/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_renamed_autohotkey/
- https://www.autohotkey.com/

name: AWS Bedrock Claude Sensitive Data in Prompts
id: 39346724-a73a-4e01-8e93-4f4791e1a0bb
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Rod Soto
status: production
type: Anomaly
description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id
    | eval prompt_text = mvjoin(prompt_mv, " || ")
    | where isnotnull(prompt_text) AND isnotnull(user_arn)
    | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$"
    | where match(prompt_text,"\b(AKIA|ASIA|AROA)[0-9A-Z]{16}\b|gh[pousr]_[A-Za-z0-9]{36}|xox[bpars]-[0-9A-Za-z-]{10,72}|sk_live_[0-9A-Za-z]{24,}|sk-(ant-)?[A-Za-z0-9-]{20,}|AIza[0-9A-Za-z_-]{35}|-----BEGIN[ A-Z]*PRIVATE KEY-----")
    OR match(prompt_text,"(?i)\b(pass(word|wd)?|pwd|secret[_-]?key|access[_-]?key|api[_-]?key|private[_-]?key)\b\s*[:=]\s*[^\s\"']{6,}")
    OR match(prompt_text,"(?i)\bbearer\s+[A-Za-z0-9._-]{20,}")
    OR match(prompt_text,"(?i)\b(ssn|social\s*security)\b.{0,20}\d{3}-\d{2}-\d{4}")
    OR match(prompt_text,"\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b")
    OR match(prompt_text,"\b(4\d{3}|5[1-5]\d{2}|6011)(?:[ -]?\d{4}){3}\b|\b3[47]\d{2}[ -]?\d{6}[ -]?\d{5}\b")
    | table _time, user, user_arn, account_id, modelId, prompt_text, host
    | sort - _time
    | `aws_bedrock_claude_sensitive_data_in_prompts_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: Some false positives may arise from legitimate user interactions with the AI model that contain sensitive data for testing or demonstration purposes. It is important to review the context of the detected prompts to determine if they represent actual sensitive data exposure or benign usage.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: Sensitive data detected in prompt on $host$ with $user_arn$ (account $account_id$) to model $modelId$. The prompt may contain credentials, SSNs, or other sensitive information.
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '1073.1110'
title: Common Active Directory Commands
description: 'Detects the possible execution of specific AD commands on hosts. Threat
  Actor Association: APT29/Nobelium/Cozy Bear, APT41, FIN6, FIN10, Carbanak, CL-STA-0043,
  Lapsus$, Lazarus, MuddyWater, Sandworm Team, TA428, Turla, UNC2596, Vice Society,
  Volt Typhoon (Bronze Silhouette, Vanguard Panda), Witchetty, Wizard Spider Software
  Association: Akira, ALPHV/BlackCat, AvosLocker, Bazarloader, BianLian, Black Basta,
  Clop, Conti, Cuba, Havex, IcedID, Insekt, Lockbit, Revil, Ryuk, Snatch, WASTEDLOCKER
  Tags: TrendingThreat, Russia, Ukraine'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (signature_id=4104 ("csvde.exe"
  OR "dsacls.exe" OR "dcpromo.exe" OR "dcdiag.exe" OR "dsamain.exe" OR "dsmgmt.exe"
  OR "ldifde.exe" OR "ldp.exe" OR "netdom.exe" OR "nltest.exe" OR "setspn.exe" OR
  ("net" AND ("/domain" OR "computer" )) OR "whoami /groups" OR "ADComputer*" OR "ADGroup*"
  OR "ADUser*" OR "ADOrganizationalUnit*" OR "ADGroupMember*" OR "Get-AdmPwdPassword*"
  OR "ADAccount*" OR "ADObject*" OR "ADDomain*" OR "ADDefaultDomainPasswordPolicy*"
  OR "ADForest" OR "ADPrincipal*" OR "ADService*" OR "ADResourceProperty*" OR "ADResource*"
  OR "ADFineGrainedPasswordPolicy*" OR "ADClaim*" OR "ADCentral*" OR "ADAuthentication*"
  OR "ADDirectory*" OR "ADTrust" OR "ADRoot*" OR "ADOptional*" OR "Get-Net*" OR "Find-GPO*"
  OR "Get-Domain*")) | eval process=coalesce(process,Message), process_path=coalesce(process_path,Path)
  | rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating
  Scriptblock.+)//g" | rex field=process max_match=0 "(?i)(?<process2>([^\s\.\\\]+)?((csvde\.exe)|(dsacls\.exe)|(dcpromo\.exe)|(dcdiag\.exe)|(dsamain\.exe)|(dsmgmt\.exe)|(ldifde\.exe)|(ldp\.exe)|(netdom\.exe)|(nltest\.exe)|(setspn\.exe)|(net.+((/domain)|(computer)))|(whoami\s+/groups)|(ADComputer)|(ADGroup)|(ADUser)|(ADOrganizationalUnit)|(ADGroupMember)|(Get-AdmPwdPasswor)|(ADAccount)|(ADObject)|(ADDomain)|(ADDefaultDomainPasswordPolicy)|(ADForest)|(ADPrincipal)|(ADService)|(ADResourceProperty)|(ADResource)|(ADFineGrainedPasswordPolicy)|(ADClaim)|(ADCentral)|(ADAuthentication)|(ADDirectory)|(ADTrust)|(ADRoot)|(ADOptional)|(Get-Net)|(Find-GPO)|(Get-Domain))(\S+)?(\s+)?[^\n\r]{0,40})"
  | rex field=process2 mode=sed "s/([\n\r]+)|(\s\s+)//g" | rename process2 as process
  | fields - process2 | table _time, host, user, dvc, event_id, host, process, process_path,
  signature_id, tag, user_id | bin span=300s | stats values(*) as * by _time, host
  | where isnotnull(process) '
techniques:
- discovery:account discovery:domain account
- discovery:system service discovery
technique_id:
- T1087.002
- T1007
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

name: Disable Defender BlockAtFirstSeen Feature
id: 2dd719ac-3021-11ec-97b4-acde48001122
version: 16
creation_date: '2021-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry to disable the Windows Defender BlockAtFirstSeen feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet and the DisableBlockAtFirstSeen value. This activity is significant because disabling this feature can allow malicious files to bypass initial detection by Windows Defender, increasing the risk of malware infection. If confirmed malicious, this action could enable attackers to execute malicious code undetected, leading to potential system compromise and data breaches.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - Azorult
    - CISA AA23-347A
    - IcedID
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: GitHub Enterprise Pause Audit Log Event Stream
id: 21083dcb-276d-4ef9-8f7e-2113ca5e8094
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when a user pauses audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that temporarily suspend the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by temporarily disabling the audit trail. For a SOC, identifying the pausing of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected during the pause window. The impact could be severe as organizations temporarily lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection during the pause period. This creates a temporary blind spot in security monitoring and incident response capabilities.
data_source:
    - GitHub Enterprise Audit Logs
search: |-
    `github_enterprise` action=audit_log_streaming.update reason="User initiated pause"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, user_agent, action,
           reason
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_enterprise_pause_audit_log_event_stream_filter`
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
    - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Audit log event streaming is paused by $user$
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
    - NPM Supply Chain Compromise
asset_type: GitHub
mitre_attack_id:
    - T1685.002
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Kubernetes Scanner Image Pulling
id: 4890cd6b-0112-4974-a272-c5c153aee551
version: 10
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects the pulling of known Kubernetes security scanner images such as kube-hunter, kube-bench, and kube-recon. It leverages Kubernetes logs ingested through Splunk Connect for Kubernetes, specifically monitoring for messages indicating the pulling of these images. This activity is significant because the use of security scanners can indicate an attempt to identify vulnerabilities within the Kubernetes environment. If confirmed malicious, this could lead to the discovery and exploitation of security weaknesses, potentially compromising the entire Kubernetes cluster.
data_source: []
search: |-
    `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
      | rename object.* AS *
      | rename involvedObject.* AS *
      | rename source.host AS host
      | eval phase="operate"
      | eval severity="high"
      | stats min(_time) as firstTime max(_time) as lastTime count
        BY host, name, namespace,
           kind, reason, message,
           phase, severity
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `kubernetes_scanner_image_pulling_filter`
how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/splunk/splunk-connect-for-kubernetes
finding:
    title: Kubernetes Scanner image pulled on host $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Dev Sec Ops
asset_type: Kubernetes
mitre_attack_id:
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Persistence and Privilege Escalation Risk Behavior
id: ad5ac21b-3b1e-492c-8e19-ea5d5e8e5cf1
version: 11
creation_date: '2022-07-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Correlation
description: The following analytic identifies potential Linux persistence and privilege escalation activities. It leverages risk scores and event counts from various Linux-related data sources, focusing on tactics associated with persistence and privilege escalation. This activity is significant for a SOC because it highlights behaviors that could allow an attacker to maintain access or gain elevated privileges on a Linux system. If confirmed malicious, this activity could enable an attacker to execute code with higher privileges, persist in the environment, and potentially access sensitive information, posing a severe security risk.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE (
            All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques")
            OR
            source = "*Linux*"
        )
        All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count >= 4
    | `linux_persistence_and_privilege_escalation_risk_behavior_filter`
how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to finding  for point detections, anomaly should not be findings but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a finding. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.
known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers.
references:
    - https://attack.mitre.org/tactics/TA0004/
finding:
    title: Linux Persistence and Privilege Escalation Risk Behavior - $risk_object$
    entity:
        field: risk_object
        type: system
        score: 0
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1548
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit

name: Malicious PowerShell Process - Encoded Command
id: c4db14d9-7909-48b4-a054-aa14d89dbb19
version: 21
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community
status: production
type: Hunting
description: |
    The following analytic detects the use of the EncodedCommand parameter in PowerShell processes.
    It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types.
    This activity can be significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder.
    If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
    Review parallel events to determine legitimacy and tune based on known administrative scripts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    `process_powershell`
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where match(process,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?")
    | `malicious_powershell_process___encoded_command_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |
    False positives are expected from legitimate PowerShell scripts,
    system administrators, and applications. Filter as needed.
references:
    - https://regexr.com/662ov
    - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
    - https://ss64.com/ps/powershell.html
    - https://twitter.com/M_haggis/status/1440758396534214658?s=20
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - CISA AA22-320A
    - Hermetic Wiper
    - Sandworm Tools
    - Qakbot
    - Volt Typhoon
    - NOBELIUM Group
    - Data Destruction
    - Lumma Stealer
    - Malicious PowerShell
    - DarkCrystal RAT
    - WhisperGate
    - Crypto Stealer
    - Microsoft SharePoint Vulnerabilities
    - Scattered Spider
    - GhostRedirector IIS Module and Rungan Backdoor
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1027
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: RunDLL Loading DLL By Ordinal
id: 6c135f8d-5e60-454e-80b7-c56eed739833
version: 16
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Michael Haag, David Dorsey, Splunk
status: production
type: TTP
description: The following analytic detects rundll32.exe loading a DLL export function by ordinal value. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. This behavior is significant because adversaries may use rundll32.exe to execute malicious code while evading security tools that do not monitor this process. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to system compromise, privilege escalation, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_rundll32`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where match(process,"rundll32.+\#\d+")
    | `rundll_loading_dll_by_ordinal_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
references:
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://twitter.com/M_haggis/status/1491109262428635136
    - https://twitter.com/pr0xylife/status/1590394227758104576
finding:
    title: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
analytic_story:
    - Unusual Processes
    - Suspicious Rundll32 Activity
    - Living Off The Land
    - IcedID
asset_type: Endpoint
mitre_attack_id:
    - T1218.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '43757.85556'
title: Security Software Discovery via Findstr.exe
description: Threat actors may enumerate security software, configurations, and monitoring
  tools on a system or cloud environment to evade defenses or tailor their attack.
  This can involve querying registry keys, running system commands, or checking for
  specific processes related to security tools. This use case detects instances where
  findstr.exe or find.exe are executed to search for security software on the host.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("findstr.exe" OR TERM(findstr) OR "find.exe" OR TERM(find)) ("avira" OR "cb" OR
  "cylance" OR "defender" OR "kaspersky" OR "kes" OR "mc" OR "sec" OR "sentinel" OR
  "symantec" OR "virus" OR "wrsa" OR "opssvc" OR "avastui" OR "avgui" OR "bdservicehost"
  OR "nsWscSvc" OR "ekrn" OR "sophoshealth" OR "falcon") | where match(process_path,
  "(?i)\x5cWindows\x5cSystem32\x5cfindstr\.exe|\x5cWindows\x5cSysWOW64\x5cfind\.exe")
  and match(process, "(?i)\w+(\.exe)?\x22?\s+(avira|cb|cylance|defender|kaspersky|kes|mc|sec|sentinel|symantec|virus|wrsa|opssvc|avastui|avgui|bdservicehost|nsWscSvc|ekrn|sophoshealth|falcon)\x22?$")
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1518/001/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/findstr
- https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/

id: '6101.6560'
title: Service Installed
description: 'Adversaries may abuse the Windows service control manager to execute
  malicious commands or payloads. This use case looks for when a service installed
  event code has triggered. Adversaries can also use native tools such as wce.exe
  or even psexec.exe to install a service. - Eventcode 4697 The minimum OS version
  is Server 2016 or Windows 10. Eventcode 7045 Windows Server 2008 R2 and 7, Windows
  Server 2012 R2 and 8.1, Windows Server 2016 and 10 - Threat Actor Association: Akira,
  Alloy Taurus/Gallium, APT29/Nobelium/Cozy Bear, APT43, Earth Estries, Lancefly,
  Lazarus, Redfly - Software Association: Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR
  "<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") |eval service_name=Service_Name,
  service_path=Service_File_Name, service_id=Service_Account | table _time, host,
  user, signature_id, service_* | bin span=1s | stats values(*) as * by _time, host
  | eventstats dc(service_name) as dc_service by service_name | where dc_service <
  6 '
techniques:
- execution:system services
- persistence:create or modify system process
technique_id: 
- T1569
- T1543
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

id: '28655.52131'
title: Suspicious InprocServer32 Registry Modification
description: The Windows Disk Cleanup utility is a legacy tool designed to delete
  cache and temporary files to improve system performance and free up hard disk space.
  Threat actors may insert a malicious DLL path into the registry key for the Disk
  Cleanup Scheduled Task, ensuring that their code is executed whenever Disk Cleanup
  runs, thus maintaining persistence on the compromised system without immediate detection.
  This use case detects commands to edit Disk Cleanup registry keys to include DLLs.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(reg) OR "reg.exe") (TERM(add) "/t" "/d"
  "/v") "HKCU\\SOFTWARE\\Classes\\CLSID\\*\\InprocServer32" ".dll" | table _time,
  host, user, parent_process_name, process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://pentestlab.blog/2024/01/29/persistence-disk-clean-up/
- https://cocomelonc.github.io/persistence/2022/11/16/malware-pers-19.html
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/

name: Svchost LOLBAS Execution Process Spawn
id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
version: 15
creation_date: '2021-11-23'
modification_date: '2026-07-27'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: |-
    The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts.
    If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.parent_process = "*"
    Processes.parent_process_name = "svchost.exe"
    Processes.process_name IN (
        "At.exe", "Atbroker.exe", "Bash.exe", "Bitsadmin.exe", "Certoc.exe", "Cmstp.exe",
        "Diskshadow.exe", "Dnscmd.exe", "Extexport.exe", "Forfiles.exe", "Ftp.exe",
        "Gpscript.exe", "Hh.exe", "Ie4uinit.exe", "Ieexec.exe", "Infdefaultinstall.exe",
        "Installutil.exe", "Mavinject.exe", "Microsoft.Workflow.Compiler.exe",
        "Msbuild.exe", "Msconfig.exe", "Msdt.exe", "Msiexec.exe", "Netsh.exe",
        "Odbcconf.exe", "OfflineScannerShell.exe", "Pcalua.exe", "Pcwrun.exe",
        "Pnputil.exe", "PresentationHost.exe", "Rasautou.exe", "Regasm.exe",
        "Register-cimprovider.exe", "Regsvcs.exe", "Regsvr32.exe", "Runonce.exe",
        "Runscripthelper.exe", "Schtasks.exe", "Scriptrunner.exe", "SettingSyncHost.exe",
        "Stordiag.exe", "Syncappvpublishingserver.exe", "Ttdinject.exe", "Mshta.exe",
        "Tttracer.exe", "Verclsid.exe", "Wab.exe", "Wmic.exe",
        "WorkFolders.exe", "Wuauclt.exe", "Xwizard.exe"
    )
    NOT (
        Processes.parent_process IN ("*-k GPSvcGroup*", "*-k netsvcs", "*-k netsvcs -p","*-k netsvcs -p -s gpsvc")
        Processes.process_name = "Gpscript.exe"
    )
    NOT (
        Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule")
        Processes.process_name IN ("Wuauclt.exe", "Schtasks.exe")
    )
    NOT (
        Processes.parent_process = "*-k DcomLaunch*"
        Processes.process_name IN ("PresentationHost.exe", "SettingSyncHost.exe")
    )

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
       Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `svchost_lolbas_execution_process_spawn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate applications may trigger this behavior, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1053/005/
    - https://www.ired.team/offensive-security/persistence/t1053-schtask
    - https://lolbas-project.github.io/
finding:
    title: The parent process[$parent_process$] spawned a Living Off The Land process [$process_name$] on [$dest$]
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Lateral Movement
    - Living Off The Land
    - Scheduled Tasks
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Wermgr Process Create Executable File
id: ab3bcce0-a105-11eb-973c-acde48001122
version: 11
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the wermgr.exe process creating an executable file. It leverages Sysmon EventCode 11 to identify instances where wermgr.exe generates a .exe file. This behavior is unusual because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate TrickBot malware, which injects code into wermgr.exe to execute malicious actions like downloading additional payloads. If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
data_source:
    - Sysmon EventID 11
search: |-
    `sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
      | stats  min(_time) as firstTime max(_time) as lastTime count
        BY action dest file_name
           file_path process_guid process_id
           user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `wermgr_process_create_executable_file_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: Wermgr.exe writing executable files on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Trickbot
asset_type: Endpoint
mitre_attack_id:
    - T1027
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Archived Collected Data In TEMP Folder
id: cb56a1ea-e0b1-46d5-913f-e024cba40cbe
version: 10
creation_date: '2024-10-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of archived files in a temporary folder, which may contain collected data. This behavior is often associated with malicious activity, where attackers compress sensitive information before exfiltration. The detection focuses on monitoring specific directories, such as temp folders, for the presence of newly created archive files (e.g., .zip, .rar, .tar). By identifying this pattern, security teams can quickly respond to potential data collection and exfiltration attempts, minimizing the risk of data breaches and improving overall threat detection.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
      max(_time) as lastTime
    FROM datamodel=Endpoint.Filesystem where
      Filesystem.file_name IN ("*.zip", "*.rar", "*.tar", "*.7z")
      Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*\\Windows\\Temp\\*")
    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size
       Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_archived_collected_data_in_temp_folder_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: |
    Some installers, debugging or support tools may create archive files in the temp folder.
    Legitimate software may also use temporary folders for archiving purposes.
    Review and apply filters as needed.
references:
    - https://x.com/suyog41/status/1825869470323056748
    - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An archive file [$file_name$] was created in a temporary folder on [$dest$].
analytic_story:
    - Braodo Stealer
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1560
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Increase in User Modification Activity
id: 0995fca1-f346-432f-b0bf-a66d14e6b428
version: 9
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
data_source:
    - Windows Event Log Security 4720
search: |-
    `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
      | bucket span=5m _time
      | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
        BY _time, src_user, signature,
           status
      | eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std
        BY src_user, signature
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
      | search isOutlier=1
      | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature
        BY _time, src_user, status
      | `windows_increase_in_user_modification_activity_filter`
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
known_false_positives: Genuine activity
references: []
finding:
    title: Spike in User Modification actions performed by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit