Splunk rules: 31

id: '36746.64790'
title: Certificate Enumeration - Windows
description: Threat actors may use tools such as Certipy or Certify.exe to enumerate
  misconfigurations in certificate services, allowing them to gather information on
  potential vulnerabilities that could be exploited for privilege escalation or lateral
  movement within a network. This use case identifies potential abuse of Active Directory
  Certificate Services by monitoring file access events (event ID 5145) related to
  certificate or certification authority data or process creation events (event ID
  4688) involving tools commonly used to enumerate or exploit vulnerable configurations
  in AD CS (e.g., Certipy or Certify).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=5145) OR
  "<EventID>5145<") (RelativeTargetName="cert" OR RelativeTargetName="certificate"
  OR RelativeTargetName="certification_authority")) OR ((TERM(EventCode=4688) OR "<EventID>4688<"
  OR Type=Process) ("certipy" OR "find" OR "vulnerable" OR "enrolleeSuppliesSubject"
  OR TERM(/ca)) OR "certify.exe") | where match(signature_id, "5145") or (match(signature_id,
  "4688") and match(process, "(?i)(certipy|find|vulnerable|enrolleeSuppliesSubject|/ca)\s")
  and !match(process_name, "(?i)find\.exe")) or match(process_name, "(?i)certify\.exe")
  | table _time, host, user user, process, process_*, parent_*, signature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge authentication certificates
technique_id: 
- T1649
data_category:
- Windows event logs
references:
- https://github.com/ly4k/Certipy
- https://www.kali.org/tools/certipy-ad/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

id: '5327.5411'
title: Certutil File Download
description: 'There are attack scenarios in which attackers download different tools
  or scripts in order to take full control over certain machines. For example, an
  attacker gets a reverse shell on the target but is a low privileged shell. In this
  situation, the attacker can download different exploits on the target for privilege
  escalation using tools such as wget. -- Threat Actor Association: APT41, DarkSide,
  BlackMatter, APT31, Flax Typhoon, Wizard Spider - Software Association: ALPHV/BlackCat,
  Babuk, Bazar, Conti -- Atomics T1027 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((TERM(certutil) AND TERM(--urlcache))
  OR TERM(--urlcache) ) AND (EventCode=4104 OR EventCode=4103) | rex field=process
  mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating Scriptblock.+)//g"|
  rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"| rex field=process (?<ip>"(\d{1,3}\.){3}\d{1,3}\:\d{1,5})"|
  rex field=process (?<website>"(?i)(http|sftp|ftp|https)\:\/{2}[A-Za-z0-9\.\/~\-\_]+")|
  rex field=process (?<download_tool>"(?i)certutil") | table _time, host, user, ip,
  download_tool, process, website, signature_id | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:obfuscated files or information
technique_id: 
- T1105
- T1027
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.ired.team/offensive-security/defense-evasion/downloading-file-with-certutil

id: '8199.10096'
title: Certutil Root Certificate Install
description: 'Adversaries may install a root certificate on a compromised system to
  avoid warnings when connecting to adversary controlled web servers. Root certificates
  are used in public key cryptography to identify a root certificate authority (CA).
  Atomics T1553.004 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") TERM(-addstore) | table _time, host, user, signature_id, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:subvert trust controls:install root certificate
technique_id:
- T1553.004
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://unit42.paloaltonetworks.com/retefe-banking-trojan-targets-sweden-switzerland-and-japan/

id: '39961.72291'
title: Cipher.exe Execution
description: Cipher.exe is a Windows command-line utility used for managing encryption
  on NTFS drives and securely overwriting data to prevent recovery. Threat actors
  may destroy data on specific systems or across a network to disrupt the availability
  of systems, services, or resources. This often involves overwriting files or data
  on local and remote drives, rendering the information irrecoverable. Unlike basic
  file deletion commands (e.g., del or rm), which typically remove file pointers but
  leave data recoverable through forensic techniques, this method ensures complete
  data loss by overwriting the content. Threat actors may overwrite files and directories
  with random data or other content to prevent recovery and obscure their activity.
  This tactic targets individual files rather than wiping entire disk sections or
  logical structures. This use case detects the execution of cipher.exe with the /w
  flag, accounting for instances where the binary has been renamed. Executions of
  processes using arguments with the pattern " /w:" followed by non-numeric characters
  should be allowlisted to reduce false positives.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "cipher.exe" OR TERM(cipher) | regex process_path="(?i)\x5ccipher\.exe" | table
  _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- impact:data destruction
technique_id: 
- T1485
data_category:
- Windows Sysmon
references:
- https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/use-cipher-to-overwrite-deleted-data

name: Detect SharpHound Command-Line Arguments
id: a0bdd2f6-c2ff-11eb-b918-acde48001122
version: 12
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as SharpHound is commonly used for Active Directory enumeration, which can be a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially compromising sensitive information and critical systems.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_sharphound_command_line_arguments_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
references:
    - https://attack.mitre.org/software/S0521/
    - https://thedfirreport.com/?s=bloodhound
    - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
    - https://github.com/BloodHoundAD/SharpHound3
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
finding:
    title: Possible SharpHound command-Line arguments identified on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Discovery Techniques
    - Ransomware
    - BlackSuit Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '25100.46548'
title: Event Logs Queried for RDP Sessions
description: 'Threat actors may query Windows Terminal Services logs for RDP session
  information. - Example 1: During post-compromise reconnaissance activities, Lazarus
  was observed using wevtutil to query Windows Terminal Services logs for RDP sessions
  (Event Code 25) in order to gather session reconnection information. - Example 2:
  Threat actor tracked as Cluster Charlie (STAC1305) searched Windows Event Logs for
  Windows Remote Connection Manager event ID 1149 -- This use case detects commands
  querying Terminal Services logs for event 25 for user disconnection or event 1149
  for records of successful Remote Desktop Services (RDP) logon attempt. While threat
  actors will most likely be using wevtutil to perform the queries, it has been omitted
  from the logic to account for instances where it has been renamed. -- Threat Actor
  Association: Cluster Charlie (STAC1305), Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("qe" OR "Query-Event") "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
  ("EventID=25" OR "EventID=1149") | table _time, host, user, process, process_*,
  user, parent_process_name, parent_process_path | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- discovery:system information discovery
technique_id: 
- T1082
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/
- https://news.sophos.com/en-us/2024/09/10/crimson-palace-new-tools-tactics-targets/

name: File with Samsam Extension
id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
version: 13
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: |
    The following analytic detects file writes with extensions indicative of a SamSam ransomware attack.
    It leverages file-system activity data to identify file names ending in .stubbin, .berkshire, .satoshi, .sophos, or .keyxml.
    This activity is significant because SamSam ransomware is highly destructive, leading to file encryption and ransom demands.
    If confirmed malicious, the impact includes significant financial losses, operational disruptions, and reputational damage.
    Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Filesystem.user) as user
            values(Filesystem.dest) as dest
            values(Filesystem.file_path) as file_path
    from datamodel=Endpoint.Filesystem where
    Filesystem.file_name IN (
      "*.berkshire",
      "*.keyxml",
      "*.satoshi",
      "*.sophos",
      "*.stubbin"
    )
    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl Filesystem.file_size
       Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | rex field=file_name "(?<file_extension>\.[^\.]+)$"
    | search file_extension IN (".berkshire", ".keyxml", ".satoshi", ".sophos", ".stubbin")
    | `file_with_samsam_extension_filter`
how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
known_false_positives: |
    Because these extensions are not typically used in normal operations, you should investigate all results.
references: []
finding:
    title: The $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - SamSam Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Get ADUser with PowerShell
id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
version: 10
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with command-line arguments used to enumerate domain users via the `Get-ADUser` cmdlet. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to gather information about domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, enabling attackers to identify high-value targets and plan subsequent attacks.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="cmd.exe"
            OR
            Processes.process_name="powershell*"
        )
        AND Processes.process = "*Get-ADUser*" AND Processes.process = "*-filter*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_aduser_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://www.blackhillsinfosec.com/red-blue-purple/
    - https://attack.mitre.org/techniques/T1087/002/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Data Destruction Command
id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c
version: 10
creation_date: '2023-02-08'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd`  (proctitle = "*rm *" AND proctitle = "*-rf *" AND proctitle = "*--no-preserve-root*")
      | rename host as dest
      | rename comm as process_name
      | rename exe as process
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_data_destruction_command_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: No false positives have been identified at this time.
references:
    - https://cert.gov.ua/article/3718487
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
finding:
    title: A [$proctitle$] event occurred on host - [$dest$] to destroy data.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Data Destruction
    - AwfulShred
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Data Transfer Size Limits Via Split Syscall
id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e
version: 9
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL comm=split OR exe= "*/split"
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           success dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] that limits the size of data transfer.
analytic_story:
    - Linux Living Off The Land
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1030
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 OAuth App Mailbox Access via EWS
id: e600cf1a-0bef-4426-b42e-00176d610a4d
version: 11
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information.
data_source:
    - O365 MailItemsAccessed
search: |-
    `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
      | regex ClientInfoString="^Client=WebServices;ExchangeWebServices"
      | fillnull
      | stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src
        BY user ClientAppId OperationCount
           AppId vendor_account vendor_product
           dest signature ClientInfoString
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_oauth_app_mailbox_access_via_ews_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: OAuth applications may access mailboxes for legitimate purposes, you can use the src_ip to add trusted sources to an allow list.
references:
    - https://attack.mitre.org/techniques/T1114/002/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/ews-applications-and-the-exchange-architecture
finding:
    title: An OAuth application identified with id $ClientAppId$ accesed mailboxes through the Graph API.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Print Spooler Adding A Printer Driver
id: 313681a2-da8e-11eb-adad-acde48001122
version: 12
creation_date: '2021-07-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the addition of new printer drivers by monitoring Windows PrintService operational logs, specifically EventCode 316. This detection leverages log data to identify messages indicating the addition or update of printer drivers, such as "kernelbase.dll" and "UNIDRV.DLL." This activity is significant as it may indicate exploitation attempts related to vulnerabilities like CVE-2021-34527 (PrintNightmare). If confirmed malicious, attackers could gain code execution or escalate privileges, potentially compromising the affected system. Immediate isolation and investigation of the endpoint are recommended.
data_source:
    - Windows Event Log Printservice 316
search: |-
    `printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*"
      | stats  count min(_time) as firstTime max(_time) as lastTime
        BY OpCode EventCode ComputerName
           Message
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `print_spooler_adding_a_printer_driver_filter`
how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
known_false_positives: No false positives have been identified at this time.
references:
    - https://twitter.com/MalwareJake/status/1410421445608476679?s=20
    - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available
    - https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675
    - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
finding:
    title: Suspicious print driver was loaded on endpoint $ComputerName$.
    entity:
        field: ComputerName
        type: system
        score: 50
analytic_story:
    - PrintNightmare CVE-2021-34527
    - Black Basta Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
    - CVE-2021-1675
mitre_attack_id:
    - T1547.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '20368.36066'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
  use it as a means to execute various behaviors, such as gathering information for
  Discovery as well as remote Execution of files as part of Lateral Movement. This
  use case detects execution of WMIC commands with the ''/node'' switch, indicating
  potential remote operations or information gathering attempts on network endpoints.
  -- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=1) OR "<EventID>1<")
  (TERM(wmic) OR "wmic.exe") OR "/node:" | regex process="(?i)/node:" | table _time,
  host, user process, process_*, parent_* | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:windows management instrumentation
technique_id: 
- T1047
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

name: Ryuk Wake on LAN Command
id: 538d0152-7aaa-11eb-beaa-acde48001122
version: 14
creation_date: '2021-03-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of Wake-on-LAN commands associated with Ryuk ransomware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process and command-line activities. This behavior is significant as Ryuk ransomware uses Wake-on-LAN to power on devices in a compromised network, increasing its encryption success rate. If confirmed malicious, this activity could lead to widespread ransomware encryption across multiple endpoints, causing significant operational disruption and data loss. Immediate isolation and thorough investigation of the affected endpoints are crucial to mitigate the impact.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Processes WHERE

    Processes.process IN (
        "* 8 LAN",
        "* 8 LAN *",
        "* 9 REP",
        "* 9 REP *"
    )

    BY Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ryuk_wake_on_lan_command_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited to no known false positives.
references:
    - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
    - https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/
    - https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf
finding:
    title: A process $process_name$ with wake on LAN commandline $process$ on host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process $process_name$ with wake on LAN commandline $process$ on host $dest$
analytic_story:
    - Compromised Windows Host
    - Ryuk Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1059.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5477.5647'
title: Task Manager lsass Dump
description: 'The Windows Task Manager may be used to dump the memory space of lsass.exe
  to disk for processing with a credential access tool such as Mimikatz. This is performed
  by launching Task Manager as a privileged user, selecting lsass.exe, and clicking
  “Create dump file”. This saves a dump file to disk with a deterministic name that
  includes the name of the process being dumped. - Threat Actor Association: APT29/Nobelium,
  UNC2465, UNC5221, UTA0178 - Software Association: Blackcat/ALPHV, Lockbit, Play,
  PYSA/Mespinoza, Rhysida, SmokedHAM - Atomics T1003.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (taskmgr.exe AND lsass.exe
  AND (TERM(EventCode=4663) OR "<EventID>4663<" OR TERM(EventCode=4656) OR "<EventID>4656<")
  AND TERM(Read) AND TERM(from) AND TERM(Process) AND TERM(memory)) OR (taskmgr.exe
  AND (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)) OR (TERM(EventCode=4673)
  OR "<EventID>4673<" AND "lsass.exe") | table _time, host, user signature_id, user,
  process_id, process_name, process_path, process, parent_process_id, parent_process_name,
  parent_process_path | bin span=5s | stats values(*) as * by _time, host | where
  mvcount(signature_id)>1 '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf

id: '28106.51156'
title: Temporary File Executed from Public Folder
description: 'The BlackBerry Threat Research and Intelligence Team has detailed several
  behaviors of threat actors using the RomCom remote access trojan. One indication
  of unusual activity is the placement of binaries in Temp directories with the extension
  .tmp which are launched by processes stored in the Public folder. This use case
  detects processes executing from temporary directories with parent processes located
  in public folders. -- Threat Actor Association: UNC5812'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "\\AppData\\Local\\Temp\\" ".tmp" "\\Users\\Public" ".exe" | regex parent_process_path="(?i)\x5cUsers\x5cPublic\x5c\.exe"|
  regex process_path="(?i)\x5cAppData\x5cLocal\x5cTemp\x5c.+\.tmp" | table _time,
  host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- lateral-movement:taint shared content
technique_id: 
- T1105
- T1080
data_category:
- Windows Sysmon
references:
- https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/behavior
- https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries

name: Windows Archive Collected Data via Rar
id: 2015de95-fe91-413d-9d62-2fe011b67e82
version: 14
creation_date: '2022-12-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="Rar.exe"
        OR
        Processes.original_file_name = "Rar.exe"
        AND
        Processes.process = "*a*" Processes.process = "* -ep1*" Processes.process = "* -r*" Processes.process = "* -y*" Processes.process = "* -v5m*" Processes.process = "* -m1*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_archive_collected_data_via_rar_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: user and network administrator can execute this command.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a Rar.exe commandline used in archiving collected data on $dest$.
analytic_story:
    - DarkGate Malware
    - Salt Typhoon
    - China-Nexus Threat Activity
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1560.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple Accounts Disabled
id: 5d93894e-befa-4429-abde-7fc541020b7b
version: 11
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where more than five unique Windows accounts are disabled within a 10-minute window, as indicated by Event Code 4725 in the Windows Security Event Log. It leverages the wineventlog_security dataset, grouping data into 10-minute segments and tracking the count and distinct count of TargetUserName. This behavior is significant as it may indicate internal policy breaches or an external attacker's attempt to disrupt operations. If confirmed malicious, this activity could lead to widespread account lockouts, hindering user access and potentially disrupting business operations.
data_source:
    - Windows Event Log Security 4725
search: |-
    `wineventlog_security` EventCode=4725 status=success
      | bucket span=10m _time
      | stats count dc(user) as unique_users values(user) as user values(dest) as dest
        BY EventCode signature _time
           src_user SubjectDomainName TargetDomainName
           Logon_ID
      | where unique_users > 5
      | `windows_multiple_accounts_disabled_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be enabled.
known_false_positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/
finding:
    title: User $src_user$ disabled multiple accounts in a short period of time.
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Outlook LoadMacroProviderOnBoot Persistence
id: 93c91139-01f8-4905-802b-0d106f026b13
version: 4
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the Windows Registry key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key being enabled. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\*" Registry.registry_value_name="LoadMacroProviderOnBoot" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_loadmacroprovideronboot_persistence_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: It is unusual to modify this feature on a Windows system. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
    - https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
finding:
    title: Outlook LoadMacroProviderOnBoot registry key modified on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NotDoor Malware
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1137
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint