Splunk rules: 35

name: ASL AWS Defense Evasion Impair Security Services
id: 5029b681-0462-47b7-82e7-f7e3d37f5a2d
version: 11
creation_date: '2022-07-26'
modification_date: '2026-05-13'
author: Patrick Bareiss, Bhavin Patel, Gowthamaraj Rajendran, Splunk
status: production
type: Hunting
description: The following analytic detects the deletion of critical AWS Security Services configurations, such as CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules. It leverages Amazon Security Lake logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because adversaries often use these actions to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, leading to potential data breaches, unauthorized access, and prolonged persistence within the AWS environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_defense_evasion_impair_security_services_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: While this search has no known false positives, it is possible that it is a legitimate admin activity. Please consider filtering out these noisy events using userAgent, user_arn field names.
references:
    - https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html
    - https://docs.aws.amazon.com/cli/latest/reference/waf/index.html
    - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
analytic_story:
    - AWS Defense Evasion
asset_type: AWS Account
mitre_attack_id:
    - T1685.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: ASL AWS ECR Container Upload Unknown User
id: 886a8f46-d7e2-4439-b9ba-aec238e31732
version: 12
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl`
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_ecr_container_upload_unknown_user_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1204/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Container uploaded from unknown user $user$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

id: '29796.53836'
title: AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  the installation of AteraAgent RMM.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((EventCode=1033) OR ">1033</EventID>")
  "MsiInstaller" "AteraAgent" | table _time, host, user, process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/

name: AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation
id: 989b3702-1df3-4076-9e2f-8dcbcc2b4bef
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Rod Soto
status: production
type: Anomaly
description: Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. For each identity, monitors the usage of potentially dangerous commands and flags any anomalous activity that deviates from their historical baseline. This may indicate attempts to escalate privileges, exfiltrate data, or execute unauthorized commands.
data_source:
    - AWS Bedrock Claude
search: |-
    `aws_bedrock_claude`
    | spath output="tool_called"       path="output.outputBodyJson{}.content_block.toolUse.name"
    | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens"
    | where tool_called IN ("bash","curl","edit","write","webfetch","grep","read","read_file")
    | eval out_tokens    = coalesce(mvindex('out_tokens_stream', -1), 'output.outputTokenCount', 0)
    | eval in_tokens     = coalesce('input.inputTokenCount', 0)
    | eval user_session  = replace('identity.arn', ".*/", "")
    | eval identity_type = case(
        'identity.arn' LIKE "%botocore-session%", "automated",
        'identity.arn' LIKE "%assumed-role%",     "assumed_role",
        'identity.arn' LIKE "%user%",             "iam_user",
        true(),                                    "other")
    | stats
        count                  AS invocations,
        dc(tool_called)        AS unique_tools_used,
        sum(in_tokens)         AS total_input_tokens,
        sum(out_tokens)        AS total_output_tokens,
        values(tool_called)    AS tools_invoked,
        values('identity.arn') AS caller_list,
        values(identity_type)  AS identity_types,
        dc('identity.arn')     AS unique_callers,
        min(_time)             AS first_seen,
        max(_time)             AS last_seen
      BY modelId, region, user_session
    | eval tokens_per_call = round(total_output_tokens / invocations, 0)
    | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S")
    | eval last_seen  = strftime(last_seen  - 28800, "%Y-%m-%d %H:%M:%S")
    | eval user = user_session
    | eval severity = case(
        mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "critical",
        mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "critical",
        mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "critical",
        mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "critical",
        mvfind(tools_invoked, "bash") >= 0, "high",
        mvfind(tools_invoked, "curl") >= 0, "high",
        mvfind(tools_invoked, "edit") >= 0, "high",
        mvfind(tools_invoked, "write") >= 0, "high",
        mvfind(tools_invoked, "webfetch") >= 0, "high",
        unique_tools_used >= 3, "high",
        true(), "medium")
    | eval risk_reason = case(
        mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "bash and curl invoked together - possible download and execute chain",
        mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "bash and write invoked together - possible execution and persistence chain",
        mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "curl and edit invoked together - possible remote content retrieval and file modification",
        mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "Human identity invoking bash via AI model - direct shell execution risk",
        mvfind(tools_invoked, "bash") >= 0, "bash invoked via Bedrock Claude - shell execution through AI model",
        mvfind(tools_invoked, "curl") >= 0, "curl invoked via Bedrock Claude - network call through AI model",
        mvfind(tools_invoked, "edit") >= 0, "edit invoked via Bedrock Claude - file modification through AI model",
        mvfind(tools_invoked, "write") >= 0, "write invoked via Bedrock Claude - file write through AI model",
        mvfind(tools_invoked, "webfetch") >= 0, "webfetch invoked via Bedrock Claude - remote content retrieval through AI model",
        unique_tools_used >= 3, "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern",
        true(), "Filesystem tool invoked via Bedrock Claude")
    | where severity IN ("critical","high")
    | table severity, risk_reason, modelId, region, user,unique_tools_used, caller_list, identity_types, invocations, tools_invoked, total_input_tokens, total_output_tokens, tokens_per_call, first_seen, last_seen
    | sort -unique_tools_used, -invocations
    | `aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land.
known_false_positives: This detection may produce false positives for legitimate developer activity where authorized users invoke shell execution, file write, or network tools through Claude Code as part of normal software development, deployment automation, or infrastructure management workflows.
references:
    - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/
    - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock
    - https://research.splunk.com/stories/aws_bedrock_security/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with severity $severity$ and reason $risk_reason$.
analytic_story:
    - Suspicious AWS Bedrock Claude Activities
asset_type: Web Application
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Cisco ASA - Logging Filters Configuration Tampering
id: b87b48a8-6d1a-4280-9cf1-16a950dbf901
version: 6
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM.
    Adversaries may reduce logging levels or disable specific log categories to evade detection, hide their activities, or prevent security monitoring systems from capturing evidence of their actions. By lowering logging verbosity, attackers can operate with reduced visibility to security teams.
    The detection monitors for logging configuration commands (message ID 111008 or 111010) that modify logging destinations (asdm, console, history, mail, monitor, trap) without setting them to higher severity levels (5-notifications, 6-informational, 7-debugging), which may indicate an attempt to reduce logging verbosity.
    Investigate unauthorized logging configuration changes that reduce verbosity, especially changes performed by non-administrative accounts, during unusual hours, or without corresponding change management approval.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command = "logging *"
    command IN (
      "*asdm*",
      "*console*",
      "*history*",
      "*mail*",
      "*monitor*",
      "*trap*"
    )
    NOT command IN (
      "*notifications*",
      "*informational*",
      "*debugging*",
      "* 5*",
      "* 6*",
      "* 7*"
    )
    | fillnull
    | stats count
            earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___logging_filters_configuration_tampering_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adding the message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Admins may modify logging levels during maintenance or troubleshooting to reduce log volume. Verify against change management tickets.
    Filter known admin accounts during maintenance windows.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/I-R/asa-command-ref-I-R/m_log-lz.html
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: User $user$ executed command $command$ to tamper with logging filter configuration on the Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: User $user$ executed command $command$ to tamper with logging filter configuration on the Cisco ASA host $host$.
threat_objects:
    - field: command
      type: process
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: Cisco Secure Firewall - Wget or Curl Download
id: 173a1cb9-1814-4128-a9dc-f29dade89957
version: 9
creation_date: '2025-04-03'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects outbound connections initiated by command-line tools such as curl or wget. It leverages Cisco Secure Firewall Threat Defense logs and identifies allowed connections (action=Allow) where either the EVE_Process or ClientApplication fields indicate use of these utilities. While curl and wget are legitimate tools commonly used for software updates and scripting, adversaries often abuse them to download payloads, retrieve additional tools, or establish staging infrastructure from compromised systems. If confirmed malicious, this behavior may indicate the download phase of an attack chain or a command-and-control utility retrieval.
data_source:
    - Cisco Secure Firewall Threat Defense Connection Event
search: |
    `cisco_secure_firewall` EventType=ConnectionEvent action IN ("Trust", "Allow", "allowed") AND
    ( EVE_Process IN ("*curl*", "*wget*") OR ClientApplication IN ("cURL", "Wget") )
    | stats count min(_time) as firstTime max(_time) as lastTime
        Values(rule) as rule
        Values(url) as url
        Values(dest_port) as dest_port
        Values(ClientApplicationVersion) as ClientApplicationVersion
        Values(src_port) as src_port
        by src, dest, transport, EVE_Process, ClientApplication, action
    | table src src_port dest dest_port transport url EVE_Process ClientApplication ClientApplicationVersion rule firstTime lastTime
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___wget_or_curl_download_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The access policy must also enable logging.
known_false_positives: |
    Developers, administrators, or automation tools may use `curl` or `wget` for legitimate purposes such as software installation, configuration scripts, or CI/CD tasks.
    Security tools or health monitoring scripts may also use these utilities to check service availability or download updates.
    Review the destination `url`, frequency, and process context to validate whether the download activity is authorized.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The process $EVE_Process$ initiated an allowed connection to download content using a command-line utility ($ClientApplication$) from $url$. This behavior may indicate tool staging or payload retrieval via curl or wget.
threat_objects:
    - field: EVE_Process
      type: process_name
    - field: url
      type: url
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Network
mitre_attack_id:
    - T1053.003
    - T1059
    - T1071.001
    - T1105
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '31349.56233'
title: Command Line Utility Added to Accessibility Features
description: 'Adversaries may establish persistence and/or elevate privileges by executing
  malicious content triggered by accessibility features. Windows contains accessibility
  features that may be launched with a key combination before a user has logged in
  (ex: when the user is on the Windows logon screen). An adversary can modify the
  way these programs are launched to get a command prompt or backdoor without logging
  in to the system. This use case detects registry modification commands or events
  adding cmd.exe or PowerShell/pwsh.exe to Accessibility Features registry keys.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4657) OR
  "<EventID>4657<") OR (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process))
  "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution" "Debugger"
  ("sethc.exe" OR "utilman.exe" OR "osk.exe" OR "Magnify.exe" OR "Narrator.exe" OR
  "DisplaySwitch.exe" OR "atbroker.exe" OR "HelpPane.exe") ("cmd.exe" OR "powershell.exe"
  OR "pwsh.exe") | where (match(signature_id, "4657") and match(ObjectValueName, "(?i)Debugger")
  and match(NewValue, "(?i)(cmd|pwsh|powershell)\.exe")) or (match(signature_id, "4688")
  and match(process, "(?i)Debugger.+\x5c(cmd|pwsh|powershell)\.exe"))| table _time,
  host, user, process, parent_process_name, signature_id, ObjectValueName, NewValue
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
- persistence:event triggered execution:accessibility features
technique_id:
- T1059
- T1546.008
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1546/008/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.008/T1546.008.md#atomic-test-1---attaches-command-prompt-as-a-debugger-to-a-list-of-target-processes
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base

id: '32258.57389'
title: ComputerDefaults UAC Bypass
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects modifications
  to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is
  associated with computerdefaults.exe. Atomics T1548.002 Test #5 Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("ADD" OR "Set-ItemProperty"
  OR "sp" OR "New-Item" OR "New-ItemProperty" OR "ni") "\\software\\classes\\ms-settings\\shell\\open\\command"
  "DelegateExecute" | table _time, host, user, process, process_*, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

name: ESXi VM Exported via Remote Tool
id: 2e155547-aaac-49d3-b0ef-ceabc31fd364
version: 4
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*File download from path*" Message="*was initiated from*" | rex field=_raw "from path ''\[(?<Datastore>[^\]]+)\](?<VMPath>[^'']+)''" | rex field=_raw "initiated from ''(?<InitiatorTool>[^/]+)/(?<ToolVersion>[^@]+)@(?<InitiatorIP>\d{1,3}(?:\.\d{1,3}){3})''" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by Datastore VMPath InitiatorTool ToolVersion InitiatorIP dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_vm_exported_via_remote_tool_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Administrators may use this command when troubleshooting. Tune as needed.
finding:
    title: VM downloaded from datastore on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '6091.6541'
title: Go Run Execution
description: Malicious actors are beginning to turn to Golang as a malware language
  since it is not typically picked up by antivirus software. Although the language
  is about 10 years old, and is used by many legitimate programmers, there has not
  been as much activity with Golang malware. This use case looks for run executions
  by go.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=execve OR type=proctitle
  OR sourcetype=bash_history) TERM(GO) TERM(RUN) | rex field=_raw "(?i)proctitle\=(?<command_type>.+)"|
  eval process=mvappend(process, command_type)| fields - command_type | where isnotnull(process)
  | table _time, host, user process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
references:
- https://www.f5.com/labs/articles/threat-intelligence/new-golang-malware-is-spreading-via-multiple-exploits-to-mine-mo

id: '15997.24032'
title: Known Process Injection Commands
description: Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. This use case detects PowerShell commands associated
  with process injection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("VirtualAlloc" OR "VirtualAllocEx" OR "VirtualProtect" OR "LdrLoadDll" OR "LoadLibrary"
  OR "LoadLibraryA" OR "LoadLibraryEx" OR "GetProcAddress" OR "OpenProcess" OR "OpenProcessToken"
  OR "AdjustTokenPrivileges" OR "WriteProcessMemory" OR "CreateRemoteThread" OR "NtCreateThreadEx"
  OR "CreateThread" OR "QueueUserAPC" OR "SuspendThread" OR "ResumeThread" OR "GetDelegateForFunctionPointer")
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Windows Sysmon
- Process command-line parameters
references: null

name: O365 Compliance Content Search Started
id: f4cabbc7-c19a-4e41-8be5-98daeaccbb50
version: 12
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when a content search is initiated within the Office 365 Security and Compliance Center. It leverages the SearchCreated operation from the o365_management_activity logs under the SecurityComplianceCenter workload. This activity is significant as it may indicate an attempt to access sensitive organizational data, including emails and documents. If confirmed malicious, this could lead to unauthorized data access, potential data exfiltration, and compliance violations. Monitoring this behavior helps ensure the integrity and security of organizational data.
data_source: []
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=SearchCreated
      | rename user_id as user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           ExchangeLocations Query
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_compliance_content_search_started_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Compliance content searches may be executed for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1114/002/
    - https://learn.microsoft.com/en-us/purview/ediscovery-content-search-overview
    - https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions
    - https://learn.microsoft.com/en-us/purview/ediscovery-search-for-activities-in-the-audit-log
finding:
    title: A new compliance content search was started by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Okta Mismatch Between Source and Response for Verify Push Request
id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a
version: 11
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies discrepancies between the source and response events for Okta Verify Push requests, indicating potential suspicious behavior. It leverages Okta System Log events, specifically `system.push.send_factor_verify_push` and `user.authentication.auth_via_mfa` with the factor "OKTA_VERIFY_PUSH." The detection groups events by SessionID, calculates the ratio of successful sign-ins to push requests, and checks for session roaming and new device/IP usage. This activity is significant as it may indicate push spam or unauthorized access attempts. If confirmed malicious, attackers could bypass MFA, leading to unauthorized access to sensitive systems.
data_source:
    - Okta
search: |-
    `okta` eventType IN (system.push.send_factor_verify_push) OR (eventType IN (user.authentication.auth_via_mfa) debugContext.debugData.factor="OKTA_VERIFY_PUSH")
      | eval groupby="authenticationContext.externalSessionId"
      | eval group_push_time=_time
      | bin span=2s group_push_time
      | fillnull value=NULL
      | stats min(_time) as _time
        BY authenticationContext.externalSessionId eventType debugContext.debugData.factor
           outcome.result actor.alternateId client.device
           client.ipAddress client.userAgent.rawUserAgent debugContext.debugData.behaviors
           group_push_time
      | iplocation client.ipAddress
      | fields - lat, lon, group_push_time
      | stats min(_time) as _time dc(client.ipAddress) as dc_ip sum(eval(if(eventType="system.push.send_factor_verify_push" AND $outcome.result$="SUCCESS", 1, 0))) as total_pushes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND $outcome.result$="SUCCESS", 1, 0))) as total_successes sum(eval(if(eventType="user.authentication.auth_via_mfa" AND $outcome.result$="FAILURE", 1, 0))) as total_rejected sum(eval(if(eventType="system.push.send_factor_verify_push" AND $debugContext.debugData.behaviors$ LIKE "%New Device=POSITIVE%", 1, 0))) as suspect_device_from_source sum(eval(if(eventType="system.push.send_factor_verify_push" AND $debugContext.debugData.behaviors$ LIKE "%New IP=POSITIVE%", 1, 0))) as suspect_ip_from_source values(eval(if(eventType="system.push.send_factor_verify_push", $client.ipAddress$, ""))) as src values(eval(if(eventType="user.authentication.auth_via_mfa", $client.ipAddress$, ""))) as dest values(*) as *
        BY authenticationContext.externalSessionId
      | eval ratio = round(total_successes / total_pushes, 2)
      | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND suspect_device_from_source > 0 AND suspect_ip_from_source > 0
      | rename actor.alternateId as user
      | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
references:
    - https://attack.mitre.org/techniques/T1621
    - https://splunkbase.splunk.com/app/6553
finding:
    title: A mismatch between source and response for verifying a push request has occurred for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
    - Okta MFA Exhaustion
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '15846.23694'
title: PowerShell Downgrade
description: 'Adversaries may downgrade or use a version of system features that may
  be outdated, vulnerable, and/or does not support updated security controls such
  as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL)
  which can record executed script content. However, adversaries may attempt to execute
  a previous version of PowerShell that does not support SBL with the intent to impair
  defenses while running malicious scripts that may have otherwise been detected.
  This use case detects attempts to execute PowerShell commands using a version earlier
  than 7. -- Threat Actor Association: Earth Estries -- Atomics T1059.001 Test #12'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(-version) | regex process="(?i)powershell\.exe\s+-version\s+[123456]"
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://kurtroggen.wordpress.com/2017/05/17/powershell-security-powershell-downgrade-attacks/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-12---powershell-downgrade-attack

id: '18093.30444'
title: Remote .msi Installation
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). The Msiexec.exe binary may
  also be digitally signed by Microsoft. This use case detects attempts to install
  .msi from remote locations. -- Threat Actor Association: APT-K-47/Mysterious Elephant
  -- Atomics T1218.007 Test #11'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(/i) OR TERM(install)) ".msi") OR (TERM(EventCode=1040)
  OR TERM(EventCode=1042) OR "<EventID>1040<" OR "<EventID>1042<") "://" | where (match(process,
  "(?i)\w+tps?://\S+\.msi") and match(signature_id, "4688")) or (match(message, "(?i)\w+tps?://\S+\.msi")
  and match(signature_id, "1040|1042")) | table _time, host, user process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md#atomic-test-11---msiexecexe---execute-remote-msi-file

name: Schtasks scheduling job on remote system
id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
version: 20
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. It leverages process data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments and flags. This activity is significant as it may signify an adversary's attempt to persist or execute code remotely. If confirmed malicious, this could allow attackers to maintain access, execute arbitrary commands, or further infiltrate the network, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name = schtasks.exe
            OR
            Processes.original_file_name=schtasks.exe
        )
        (Processes.process="*/create*" AND Processes.process="*/s *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `schtasks_scheduling_job_on_remote_system_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate.
references: []
finding:
    title: A scheduled task process $process_name$ with remote job command-line $process$ on host $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A scheduled task process $process_name$ with remote job command-line $process$ on host $dest$ by $user$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Scheduled Tasks
    - Phemedrone Stealer
    - Living Off The Land
    - Prestige Ransomware
    - Quasar RAT
    - RedLine Stealer
    - Active Directory Lateral Movement
    - NOBELIUM Group
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Sdelete Application Execution
id: 31702fc0-2682-11ec-85c3-acde48001122
version: 14
creation_date: '2021-10-06'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as sdelete.exe is not commonly used in regular operations and its presence may indicate an attempt to cover malicious activities. If confirmed malicious, this could lead to the loss of critical forensic data, hindering incident response and investigation efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="sdelete.exe"
            OR
            Processes.original_file_name="sdelete.exe"
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `sdelete_application_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: user may execute and use this application
references:
    - https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
finding:
    title: sdelete process $process_name$ executed on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: sdelete process $process_name$ executed on $dest$
analytic_story:
    - Masquerading - Rename System Utilities
    - Scattered Spider
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint