Splunk rules: 33

id: '13702.20068'
title: AnyDesk Execution from Suspicious Folder
description: 'Adversaries may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These services are commonly used as legitimate technical support software,
  and may be allowed by application control within a target environment. This use
  case detects when remote access software AnyDesk is executed outside of standard
  install locations. -- Threat Actor Association: Alloy Taurus/Gallium, Gamaredon
  (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944),
  Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker,
  BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal -- Atomics T1219
  Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(AnyDesk) | regex process_path!="(?i)(AppData)|(Program\sFiles\\AnyDesk)|(Program\sFiles\s\(x86\))"|
  where match(process_name, "(?i)^anydesk.exe$") | table _time, host, user, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows

id: '25095.46534'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
  to extract encrypted credentials from Veeam databases that were decrypted using
  a publicly documented technique on Veeam''s R+D forums. This use case detects commands
  targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
  cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
  where the binary has been renamed or another utility was used to interact with the
  database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]" |
  table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html

id: '13470.19294'
title: CDB Execution
description: 'CDB is a legitimate Windows component that can be used, and abused,
  to launch 64-bit shellcode, setup network connections or attaching to any process
  and executing shell commands. As this is a common component on Windows, it can be
  leveraged to perform living-off-the-land attacks. -- Threat Actor Association: Metador
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("cdb.exe" ("-cf" OR "-cfr" OR ("-premote" ("port" OR "pipe")) OR ("-pd" "-pn")))
  OR ("-cf" OR "-cfr" OR ("-premote" ("port" OR "pipe")) OR ("-pd" "-pn")) | regex
  process="(?i)\s+\-(cf|cfr|premote|pd.*-pn|pn.*-pd)\s+" | table _time, host, user
  process, process_*, signature_id, parent_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:trusted developer utilities proxy execution
technique_id: 
- T1127
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/
- https://blog.thecybersecuritytutor.com/the-power-of-cdb-debugging-tool/

name: Cisco ASA - Logging Disabled via CLI
id: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
version: 8
creation_date: '2025-09-25'
modification_date: '2026-05-13'
author: Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects the disabling of logging functionality on a Cisco ASA device
    through CLI commands. Adversaries or malicious insiders may attempt to disable logging
    to evade detection and hide malicious activity. The detection looks for specific ASA
    syslog message IDs (111010, 111008) associated with command execution,
    combined with suspicious commands such as `no logging`, `logging disable`,
    `clear logging`, or `no logging host`. Disabling logging on a firewall or security device
    is a strong indicator of defense evasion.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command IN (
        "*no logging*",
        "*logging disable*",
        "*clear logging*",
        "*no logging host*",
        "*no logging trap*"
    )
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___logging_disabled_via_cli_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration.
    These events should be verified against approved change management activities.
references:
    - https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
    - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
finding:
    title: User $user$ executed command $command$ to disable logging on the Cisco ASA host $host$.
    entity:
        field: host
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Isovalent - Cron Job Creation
id: 94531a31-a041-4777-909f-cd92ed3b71ad
version: 5
creation_date: '2026-01-05'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a cron job within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for cron job creation events. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
data_source:
    - Cisco Isovalent Process Exec
search: |
    `cisco_isovalent_process_exec` process_name IN ("crond","cron","crontab")
    | search pod_name!=""
    | stats count
            min(_time) as firstTime
            max(_time) as lastTime
            values(process) as process
        by cluster_name pod_name parent_process_name process_name process_exec process_id node_name
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_isovalent___cron_job_creation_filter`
how_to_implement: The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior.
known_false_positives: This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations.
references:
    - https://attack.mitre.org/techniques/T1053/003/
    - https://medium.com/@bag0zathev2/cronjobs-for-hackers-bugbounty-article-7d51588d0fd5
    - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
intermediate_findings:
    entities:
        - field: pod_name
          type: system
          score: 20
          message: cron job creation detected in pod [$pod_name$] in the cluster [$cluster_name$]
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Isovalent Suspicious Activity
asset_type: Kubernetes
mitre_attack_id:
    - T1053.003
    - T1053.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: network

name: CrushFTP Server Side Template Injection
id: ccf6b7a3-bd39-4bc9-a949-143a8d640dbc
version: 8
creation_date: '2024-06-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis.
data_source:
    - CrushFTP
search: '`crushftp` | rex field=_raw "\[(?<protocol>HTTPS|HTTP):(?<session_id>[^\:]+):(?<user>[^\:]+):(?<src_ip>\d+\.\d+\.\d+\.\d+)\] (?<action>READ|WROTE): \*(?<http_method>[A-Z]+) (?<uri_query>[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") | search message!=false | rename host as dest | stats count by _time, dest, source, message, src_ip, http_method, uri_query, user, action | sort -_time| `crushftp_server_side_template_injection_filter`'
how_to_implement: CrushFTP Session logs, from Windows or Linux, must be ingested to Splunk. Currently, there is no TA for CrushFTP, so the data must be extracted from the raw logs.
known_false_positives: False positives should be limited, however tune or filter as needed.
references:
    - https://github.com/airbus-cert/CVE-2024-4040
    - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
finding:
    title: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - CrushFTP Vulnerabilities
    - Hellcat Ransomware
asset_type: Web Application
cve:
    - CVE-2024-4040
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 13
creation_date: '2022-04-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the Java process writing a .jsp file to disk, which may indicate a web shell being deployed. It leverages data from the Endpoint datamodel, specifically monitoring process and filesystem activities. This activity is significant because web shells can provide attackers with remote control over the compromised server, leading to further exploitation. If confirmed malicious, this could allow unauthorized access, data exfiltration, or further compromise of the affected system, posing a severe security risk.
data_source:
    - Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("java","java.exe", "javaw.exe")
      BY _time Processes.action Processes.dest
         Processes.original_file_name Processes.parent_process Processes.parent_process_exec
         Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
         Processes.parent_process_path Processes.process Processes.process_exec
         Processes.process_guid Processes.process_hash Processes.process_id
         Processes.process_integrity_level Processes.process_name Processes.process_path
         Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | join process_guid [
    | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name="*.jsp*"
      BY _time Filesystem.action Filesystem.dest
         Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash
         Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
         Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
         Filesystem.process_id Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | fields _time process_guid file_path file_name file_create_time user dest process_name]
    | stats count min(_time) as firstTime max(_time) as lastTime
      BY dest process_name process_guid
         file_name file_path file_create_time
         user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `java_writing_jsp_file_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
references:
    - https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
    - https://github.com/TheGejr/SpringShell
    - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
finding:
    title: An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file $file_name$ to disk, potentially indicative of exploitation.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Spring4Shell CVE-2022-22965
    - Atlassian Confluence Server and Data Center CVE-2022-26134
    - SysAid On-Prem Software CVE-2023-47246 Vulnerability
    - SAP NetWeaver Exploitation
asset_type: Endpoint
cve:
    - CVE-2022-22965
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Abuse of Secret by Unusual User Group
id: b6f45bbc-4ea9-4068-b3bc-0477f6997ae2
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets by unusual user groups. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests and user groups. This activity is significant for a SOC as Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys. If confirmed malicious, this behavior could indicate an attacker attempting to exfiltrate or misuse these secrets, potentially leading to unauthorized access to sensitive systems or data.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=secrets verb=get
      | search NOT `kube_allowed_user_groups`
      | fillnull
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_abuse_of_secret_by_unusual_user_group_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Access of Kubernetes secret $objectRef.name$ from unusual user group $user.groups{}$ by user name $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1552.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Gem Privilege Escalation
id: 0115482a-5dcb-4bb0-bcca-5d095d224236
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the RubyGems utility with elevated privileges, specifically when it is used to run system commands as root. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include "gem open -e" and "sudo". This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as the root user. If confirmed malicious, this could lead to full system compromise, enabling the attacker to gain root access and execute arbitrary commands with elevated privileges.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*gem*open*-e*"
        AND
        Processes.process="*-c*"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_gem_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/gem/
    - https://en.wikipedia.org/wiki/RubyGems
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Service File Created In Systemd Directory
id: c7495048-61b6-11ec-9a37-acde48001122
version: 13
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(lastTime)`
    | `security_content_ctime(firstTime)`
    | `linux_service_file_created_in_systemd_directory_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: False positives may arise when administrators or network operators create files in systemd directories for legitimate automation tasks. Therefore, it's important to adjust filter macros to account for valid activities. To implement this search successfully, it's crucial to ingest appropriate logs, preferably using the Linux Sysmon Add-on from Splunkbase for those using Sysmon.
references:
    - https://attack.mitre.org/techniques/T1053/006/
    - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
    - https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/
    - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A service file named as $file_path$ is created in systemd folder on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Scheduled Tasks
    - Gomir
    - China-Nexus Threat Activity
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1053.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5525.5748'
title: Native Archive Commands
description: 'An adversary may compress and/or encrypt data that is collected prior
  to exfiltration. Compressing the data can help to obfuscate the collected data and
  minimize the amount of data sent over the network. - Threat Actor Association: APT28
  (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, Conti, DarkSide, BlackMatter, FIN7, Karakurt, MuddyWater,
  TA428, Volt Typhoon, Witchetty - Software Association: Black Basta, NanoCore, Ransom
  Cartel, SquirrelWaffle - Atomics T1074.001 Test#3 Atomics T1560 Test#1 Atomics T1560.001
  Test #5 Atomics T1560.001 Test #6 Atomics T1560.001 Test #7 Atomics T1560.001 Test
  #8 Atomics T1560.001 Test #9 - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<") (TERM(Compress-Archive) OR TERM(tar) OR TERM(makecab) OR TERM(compact.exe)
  OR TERM(compact)) | table _time, host, user signature_id, process, process_*, parent_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
- collection:archive collected data
technique_id:
- T1074.001
- T1560
data_category:
- Windows event logs
references:
- https://liberty-shell.com/sec/2019/11/06/living-off-the-land-pt2/

id: '6590.7620'
title: Office Binary Download Remote File
description: 'Unsanitized file validation leads to Malicious payload download via
  Office binaries. Attackers may leverage these binaries in order to download payloads
  and bypass defenses. -- Threat Actor Association: Evilnum, FIN11, NewsPenguin -
  Software Association: Clop, Qakbot/Qbot -- Living Off the Land Binary and Scripts
  (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("POWERPNT.EXE" OR "WINWORD.EXE" OR "EXCEL.EXE"
  OR "ONENOTE.EXE" OR "mspub.exe" OR "outlook.exe" OR "msaccess.exe") | table _time,
  host, user user, process, process_*, parent_* | bin span=1s | stats values(*) as
  * by _time, host | where match(process, "(?i)\w?\wtps?\:(\/\/|\x5c\x5c)") '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191

id: '5538.5778'
title: Powershell ICMP Data Exfiltration
description: 'Adversaries may steal data by exfiltrating it over an existing command
  and control channel. Use case attempts to detect powershell scripts with specific
  ICMP calls that may be attributed to data exfil. - Software Association: Alchimist
  - Atomics T1048.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4103) TERM(System)
  TERM(Net) TERM(NetworkInformation) TERM(ping) | rex field=Message "(?i)script\s+?name\s+?\=\s+?(?<script>.{1,}?\.ps1)"
  | table _time, host, user signature_id, process, process_*, script | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- exfiltration:exfiltration over c2 channel
technique_id:
- T1059.001
- T1041
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://raw.githubusercontent.com/cyb3rw01f/icmpExfiltrater/master/icmpExfiltrater.ps1

id: '23146.42111'
title: Process Creation Using Sysnative Folder
description: 'Threat actors may use tools spawning processes from the Sysnative folder
  in an attempt to bypass the File System Redirector on 64-bit versions of Windows
  to execute 32-bit applications from the 64-bit system directory. This use cased
  detects instances where the Sysnative folder is used during process creation, a
  tactic often associated with CobaltStrike activities. Note: Sysnative is often referenced
  by legitimate processes. Allowlisting known processes is recommended to reduce false
  positives.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "Sysnative" | regex process="(?i)^[A-Z]:\x5cWindows\x5cSysnative\x5c" | table _time,
  host, user, parent_process_name, process | bin span=1s | stats values(*) as * by
  _time, host '
techniques: 
- defense-evasion:system binary proxy execution
technique_id:
- T1218
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://learn.microsoft.com/sv-se/windows/win32/winprog64/file-system-redirector

id: '11211.15637'
title: Rare executable from Microsoft Office
description: 'This use case looks for suspicious behavior from Microsoft office products.
  Filters for rarer executable files launched from a Microsoft Office product. - Threat
  Actor Association: Evilnum - Software Association: GlowSand.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ((TERM(Microsoft) TERM(Office)) OR TERM(WINWORD.EXE) OR TERM(EXCEL.EXE) OR TERM(POWERPNT.EXE)
  OR TERM(MSACCESS.EXE) OR TERM(OUTLOOK.EXE) OR TERM(VISIO.EXE) OR TERM(WINPROJ.EXE)
  OR TERM(wordpad.exe))| regex parent_process_name="(?i)((WINWORD\.EXE)|(EXCEL\.EXE)|(POWERPNT\.EXE)|(MSACCESS\.EXE)|(OUTLOOK\.EXE)|(VISIO\.EXE)|(WINPROJ\.EXE)|(wordpad\.exe)|(Microsoft\s+Office))"
  | table _time, host, user process, parent_*, process_*, signature_id | bin span=1s
  | stats values(*) as * by _time, host | eventstats c(process_name) as c_process
  by process_name| where c_process < 3 '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows Sysmon
references:
- https://borncity.com/win/2022/06/02/searchnightmare-windows-10-search-ms-uri-handler-0-day-exploit-mit-office-2019/

name: SSL Certificates with Punycode
id: 696694df-5706-495a-81f2-79501fa11b90
version: 7
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: Hunting
description: The following analytic detects SSL certificates with Punycode domains in the SSL issuer email domain, identified by the prefix "xn--". It leverages the Certificates Datamodel to flag these domains and uses CyberChef for decoding. This activity is significant as Punycode can be used for domain spoofing and phishing attacks. If confirmed malicious, attackers could deceive users and systems, potentially leading to unauthorized access and data breaches.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates
      BY All_Certificates.SSL.ssl_issuer_email_domain All_Certificates.SSL.ssl_issuer All_Certificates.SSL.ssl_subject_email
         All_Certificates.SSL.dest All_Certificates.SSL.src All_Certificates.SSL.sourcetype
         All_Certificates.SSL.ssl_subject_email_domain
    | `drop_dm_object_name("All_Certificates.SSL")`
    | eval punycode=if(like(ssl_issuer_email_domain,"%xn--%"),1,0)
    | where punycode=1
    | cyberchef infield="ssl_issuer_email_domain" outfield="convertedPuny" jsonrecipe="[{"op":"From Punycode","args":[true]}]"
    | table ssl_issuer_email_domain convertedPuny ssl_issuer ssl_subject_email dest src sourcetype ssl_subject_email_domain
    | `ssl_certificates_with_punycode_filter`
how_to_implement: Ensure data is properly being ingested into the Certificates datamodel. If decoding the of interest, the CyberChef app is needed https://splunkbase.splunk.com/app/5348. If decoding is not needed, remove the cyberchef lines.
known_false_positives: False positives may be present if the organization works with international businesses. Filter as needed.
references:
    - https://www.splunk.com/en_us/blog/security/nothing-puny-about-cve-2022-3602.html
    - https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
    - https://community.emergingthreats.net/t/out-of-band-ruleset-update-summary-2022-11-01/117
    - https://github.com/corelight/CVE-2022-3602/tree/master/scripts
analytic_story:
    - OpenSSL CVE-2022-3602
asset_type: Network
mitre_attack_id:
    - T1573
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Suspicious Regsvr32 Register Suspicious Path
id: 62732736-6250-11eb-ae93-0242ac130002
version: 18
creation_date: '2021-01-29'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the use of Regsvr32.exe to register DLLs from suspicious paths such as AppData, ProgramData, or Windows Temp directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because Regsvr32.exe can be abused to proxy execution of malicious code, bypassing traditional security controls. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
references:
    - https://attack.mitre.org/techniques/T1218/010/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
    - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
    - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
    - https://any.run/report/f29a7d2ecd3585e1e4208e44bcc7156ab5388725f1d29d03e7699da0d4598e7c/0826458b-5367-45cf-b841-c95a33a01718
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Living Off The Land
    - Qakbot
    - China-Nexus Threat Activity
    - Derusbi
    - Salt Typhoon
    - Suspicious Regsvr32 Activity
    - IcedID
asset_type: Endpoint
mitre_attack_id:
    - T1218.010
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious SQLite3 LSQuarantine Behavior
id: e1997b2e-655f-4561-82fd-aeba8e1c1a86
version: 10
creation_date: '2021-03-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of SQLite3 querying the MacOS preferences to determine the original URL from which a package was downloaded. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions involving LSQuarantine. This activity is significant as it is commonly associated with MacOS adware and other malicious software. If confirmed malicious, this behavior could indicate an attempt to track or manipulate downloaded packages, potentially leading to further system compromise or persistent adware infections.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=sqlite3 Processes.process=*LSQuarantine*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_sqlite3_lsquarantine_behavior_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://redcanary.com/blog/clipping-silver-sparrows-wings/
    - https://www.marcosantadev.com/manage-plist-files-plistbuddy/
finding:
    title: Suspicious sqlite LSQuarantine activity on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious sqlite LSQuarantine activity on $dest$
analytic_story:
    - Silver Sparrow
asset_type: Endpoint
mitre_attack_id:
    - T1074
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AppCertDLL Modification Via Command Line
id: 3ba73a2b-3396-47e4-bdef-c80e6a7895c0
version: 2
creation_date: '2021-05-07'
modification_date: '2026-07-27'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    This analytic detects attempts to modify AppCertDLL registry keys via some command line utility. Values under this key are used to specify DLLs loaded by the Windows Session Manager.
    Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges.
    If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*\\Control\\Session Manager\\AppCertDLLs*"

    by Processes.process Processes.vendor_product Processes.user_id
       Processes.process_hash Processes.parent_process_name
       Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name
       Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id
       Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_appcertdll_modification_via_command_line_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Modifications to AppCertDLL keys may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources.
references:
    - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential AppCertDLL modification activity observed on $dest$ via $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Windows Persistence Techniques
    - Windows Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1546.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chromium Process Loaded Extension via Command-Line
id: 1b8a468a-52e3-4206-b14a-73165441684c
version: 5
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects instances where Google Chrome is started with the --load-extension command-line flag, which allows loading unpacked or non-standard extensions. This behavior can indicate attempts to bypass enterprise extension policies, install malicious extensions, or load potentially harmful browser components. Monitoring such activity helps identify unauthorized extension usage, potential malware persistence mechanisms, or policy violations that could compromise browser security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
    Processes.process_name = "Chrome.exe"
    Processes.process= "*--load-extension*"

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chromium_process_loaded_extension_via_command_line_filter`
how_to_implement: |
    To successfully implement this search you need to be ingesting information
    on process that include the name of the process responsible for the changes from
    your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
    confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
    endpoint product.
known_false_positives: Developers or IT admins loading unpacked extensions for testing or deployment purposes.
references:
    - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
    - https://peter.sh/experiments/chromium-command-line-switches/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $process_name$ was launched by $parent_process_name$ on $dest$ by user $user$ and attempted to load a browser extension via command-line $process$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DnsAdmins New Member Added
id: 27e600aa-77f8-4614-bc80-2662a67e2f48
version: 12
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a new member to the DnsAdmins group in Active Directory by leveraging Event ID 4732. This detection uses security event logs to identify changes to this high-privilege group. Monitoring this activity is crucial because members of the DnsAdmins group can manage the DNS service, often running on Domain Controllers, and potentially execute malicious code with SYSTEM privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges and gain control over critical domain services, posing a significant security risk.
data_source:
    - Windows Event Log Security 4732
search: |-
    `wineventlog_security` EventCode=4732 TargetUserName=DnsAdmins
      | stats min(_time) as firstTime max(_time) as lastTime values(TargetUserName) as target_users_added values(user) as user
        BY dest src_user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_dnsadmins_new_member_added_filter`
how_to_implement: To successfully implement this search, Domain Controller events need to be ingested. The Advanced Security Audit policy setting `Audit Security Group Management` within `Account Management` needs to be enabled.
known_false_positives: New members can be added to the DnsAdmins group as part of legitimate administrative tasks. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise
    - https://www.hackingarticles.in/windows-privilege-escalation-dnsadmins-to-domainadmin/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
finding:
    title: A new member $user$ added to the DnsAdmins group by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows MSIExec Remote Download
id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda
version: 17
creation_date: '2022-06-17'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects the use of msiexec.exe with an HTTP or
    HTTPS URL in the command line, indicating a remote file download attempt. This detection
    leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
    execution logs that include command-line details. This activity is significant as
    it may indicate an attempt to download and execute potentially malicious software
    from a remote server. If confirmed malicious, this could lead to unauthorized code
    execution, system compromise, or further malware deployment within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    `process_msiexec`
    Processes.process IN ("*http://*", "*https://*")
    by Processes.action Processes.dest Processes.original_file_name
    Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
    Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
    Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
    Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
    Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_msiexec_remote_download_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    False positives may be present, filter by destination or parent process as needed.
references:
    - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 30
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
        - field: dest
          type: system
          score: 30
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Windows System Binary Proxy Execution MSIExec
    - Water Gamayun
    - Cisco Network Visibility Module Analytics
    - StealC Stealer
    - SolarWinds WHD RCE Post Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1218.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Screen Capture Via Powershell
id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170
version: 14
creation_date: '2023-04-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. It leverages PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities. This behavior is significant as it may indicate an attempt to exfiltrate sensitive information by capturing desktop screenshots. If confirmed malicious, this activity could allow an attacker to gather visual data from the compromised system, potentially leading to data breaches or further exploitation.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN (
        "*[Drawing.Graphics]::FromImage*",
        "*Drawing.Bitmap*",
        "*Graphics.FromImage*"
    )
    ScriptBlockText = "*.CopyFromScreen*"
    | fillnull
    | stats count min(_time) as firstTime max(_time) as lastTime
      BY dest signature signature_id
         user_id vendor_product EventID
         Guid Opcode Name
         Path ProcessID ScriptBlockId
         ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_screen_capture_via_powershell_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: No false positives have been identified at this time.
references:
    - https://twitter.com/_CERT_UA/status/1620781684257091584
    - https://cert.gov.ua/article/3761104
finding:
    title: A PowerShell script was identified possibly performing screen captures on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - Winter Vivern
    - Water Gamayun
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1113
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint