Splunk rules: 36

name: Azure AD Privileged Role Assigned
id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
version: 16
creation_date: '2022-08-29'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is significant as adversaries may assign privileged roles to compromised accounts to maintain persistence within the Azure AD environment. If confirmed malicious, this could allow attackers to escalate privileges, access sensitive information, and maintain long-term control over the Azure AD infrastructure.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` "operationName"="Add member to role"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename targetResources{}.modifiedProperties{}.newValue as roles
      | eval role=mvindex(roles,1)
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           result role signature
      | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
      | search isprvilegedadrole = True
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_privileged_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
    - https://adsecurity.org/?p=4277
    - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
    - https://attack.mitre.org/techniques/T1098/003/
finding:
    title: A privileged Azure AD role was assigned for User $user$ initiated by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: A privileged Azure AD role was assigned for User $user$ initiated by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
    - NOBELIUM Group
    - Scattered Lapsus$ Hunters
    - Storm-0501 Ransomware
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Cisco IOS XE WebUI Login From IOSd Local Port
id: 77a1751f-552f-456c-b9ae-cdb66eec3e42
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-19'
author: Nasreddine Bencherchali
status: production
type: TTP
description: |
    This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111.
    This is a strong an indicator of WebUI exploitation because normal users should not authenticate through the underlying IOS-XE Linux shell path.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility="SEC_LOGIN"
    mnemonic IN ("QUIET_MODE_ON", "LOGIN_SUCCESS", "LOGIN_FAILED")
    message_text="*[localport: 21111]*"
    | rex field=_raw "\[user:\s*(?<user>[^\]]+)\]"
    | rex field=_raw "\[Source:\s*(?<src_ip>[^\]]+)\]"
    | rex field=_raw "\[localport:\s*(?<local_port>[^\]]+)\]"
    | rex field=_raw "\[Reason:\s*(?<reason>[^\]]+)\]"
    | rex field=_raw "\[ACL:\s*(?<acl>[^\]]+)\]"
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(local_port) as local_port
                  values(acl) as acl
      by dest user src_ip reason
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_webui_login_from_iosd_local_port_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios".
    Login failure logging must be enabled with "login on-failure log".
known_false_positives: |
    This local port value should not appear for normal WebUI logins. So false positives should very minimal.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
finding:
    title: WebUI authentication failure with local port 21111 from $src_ip$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: WebUI authentication failure with local port 21111 from $src_ip$ on $dest$.
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1190
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '33080.58671'
title: Common Recon Commands in Short Burst
description: Most initial access broker malware run several discovery commands in
  a short time span to gather information after gaining access to a system. While
  these commands are used routinely in legitimate activity, several executions in
  rapid succession may indicate automated reconnaissance activities from malicious
  actors. This use case detects several common reconnaissance/discovery commands executed
  in a short time period (default 2 minutes).
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("whoami" OR ("net" ("group" OR "use")) OR "/Domain"
  OR "systeminfo" OR "nltest" OR "/dclist" OR "/domain_trusts" OR "ipconfig" OR "arp"
  OR "tasklist" OR "ping" OR "quser" OR "tasklist" OR "netstat" OR "netsh" OR "driverquery"
  OR "cmdkey" OR "tracert") | where !match(process, "(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c")
  and (match(process, "(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_trusts|tasklist|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert|net1?(\.exe)?\s+(group|use)($|\s|\.exe)")
  OR match(process_name, "(?i)(whoami|systeminfo|ipconfig|arp|nltest|tasklist|net1?|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert)\.exe"))
  and !match(user, "\$$") | table _time, host, user process, process_*, parent_process,
  parent_process_* | bin span=120s | stats values(*) as * by _time, host | streamstats
  dc(process) as dc_process, dc(process_name) as dc_process_name by _time, host| where
  dc_process > 3 and dc_process_name > 1 '
techniques:
- discovery:system owner/user discovery
- discovery:account discovery
- discovery:process discovery
- discovery:system information discovery
- discovery:system service discovery
- defense-evasion:virtualization/sandbox evasion:system checks
- discovery:system network connections discovery
technique_id:
- T1033
- T1087
- T1057
- T1082
- T1007
- T1497.001
- T1049
data_category:
- Windows event logs
references:
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072

name: Detect Traffic Mirroring
id: 42b3b753-5925-49c5-9742-36fa40a73990
version: 11
creation_date: '2020-10-28'
modification_date: '2026-05-13'
author: Mikael Bjerkeland, Splunk
status: experimental
type: TTP
description: The following analytic detects the initiation of traffic mirroring sessions on Cisco network devices. It leverages logs with specific mnemonics and facilities related to traffic mirroring, such as "ETH_SPAN_SESSION_UP" and "PKTCAP_START." This activity is significant because adversaries may use traffic mirroring to exfiltrate data by duplicating and forwarding network traffic to an external destination. If confirmed malicious, this could allow attackers to capture sensitive information, monitor network communications, and potentially compromise the integrity and confidentiality of the network.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*")
      | stats min(_time) AS firstTime max(_time) AS lastTime count
        BY host facility mnemonic
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `detect_traffic_mirroring_filter`
how_to_implement: This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.
known_false_positives: This search will return false positives for any legitimate traffic captures by network administrators.
references: []
finding:
    title: Traffic Mirroring Session observed on $host$
    entity:
        field: host
        type: system
        score: 50
analytic_story:
    - Router and Infrastructure Security
asset_type: Infrastructure
mitre_attack_id:
    - T1020.001
    - T1200
    - T1498
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: ESXi Syslog Config Change
id: e530beb9-9b8c-4c9b-9776-0a05521ff32d
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies changes to the syslog configuration on an ESXi host using esxcli, which may indicate an attempt to disrupt log collection and evade detection.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*syslog config set*" AND Message="*esxcli*" | rex field=_raw "\].*\[\s*(?P<user>[^\]]+)\]:\s(?P<command>.+)" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_syslog_config_change_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed
finding:
    title: Syslog config was modified on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1690
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Excessive Attempt To Disable Services
id: 8fa2a0f0-acd9-11eb-8994-acde48001122
version: 12
creation_date: '2021-05-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies a suspicious series of command-line executions attempting to disable multiple services. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes where "sc.exe" is used with parameters like "config" or "Disabled" within a short time frame. This activity is significant as it may indicate an adversary's attempt to disable security or other critical services to further compromise the system. If confirmed malicious, this could lead to the attacker achieving persistence, evading detection, or disabling security mechanisms, thereby increasing the risk of further exploitation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "sc.exe"
        AND
        Processes.process="*config*"
        OR
        Processes.process="*Disabled*"
      BY Processes.process_name Processes.parent_process_name Processes.dest
         Processes.user _time span=1m
    | where count >=4
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_attempt_to_disable_services_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - XMRig
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32248.57377'
title: Group Policy Editor Execution
description: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
  Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and
  is used in several ways in either its GUI or in a command prompt. MMC can be used
  to create, open, and save custom consoles that contain administrative tools created
  by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems
  locally or remotely. MMC can also be used to open Microsoft created .msc files to
  manage system configuration. For example, mmc gpedit.msc, will open the Group Policy
  Editor application window. This use case detects gpedit.msc executions.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(gpedit) ("mmc.exe" OR "Microsoft Management Console") | table _time, host,
  user, process | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:mmc
technique_id:
- T1218.014
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1218/014/
- https://www.itechtics.com/enable-gpedit-windows-10-home/

name: Kubernetes Cron Job Creation
id: 5984dbe8-572f-47d7-9251-3dff6c3f0c0d
version: 10
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a Kubernetes cron job, which is a task scheduled to run automatically at specified intervals. It identifies this activity by monitoring Kubernetes Audit logs for the creation events of cron jobs. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` verb=create "objectRef.resource"=cronjobs
      | fillnull
      | stats count values(user.groups{}) as user_groups
        BY kind objectRef.name objectRef.namespace
           objectRef.resource requestObject.kind requestObject.spec.schedule
           requestObject.spec.jobTemplate.spec.template.spec.containers{}.image responseStatus.code sourceIPs{}
           stage user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_cron_job_creation_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes cron job creation from user $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1053.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Deletion Of Init Daemon Script
id: 729aab57-d26f-4156-b97f-ab8dda8f44b1
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the deletion of init daemon scripts on a Linux machine. It leverages filesystem event logs to identify when files within the /etc/init.d/ directory are deleted. This activity is significant because init daemon scripts control the start and stop of critical services, and their deletion can indicate an attempt to impair security features or evade defenses. If confirmed malicious, this behavior could allow an attacker to disrupt essential services, execute destructive payloads, or persist undetected in the environment.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_deletion_of_init_daemon_script_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
finding:
    title: Init daemon script deleted on host $dest$ by process GUID- $process_guid$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - AcidRain
    - Data Destruction
    - AcidPour
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Preload Hijack Library Calls
id: cbe2ca30-631e-11ec-8670-acde48001122
version: 14
creation_date: '2022-01-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*LD_PRELOAD*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_preload_hijack_library_calls_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
finding:
    title: A commandline $process$ that may hijack library function on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Linux Persistence Techniques
    - China-Nexus Threat Activity
    - Salt Typhoon
    - Linux Privilege Escalation
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1574.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Malicious PowerShell Process - Execution Policy Bypass
id: 9be56c82-b1cc-4318-87eb-d138afaaca39
version: 21
creation_date: '2020-04-29'
modification_date: '2026-07-20'
author: Rico Valdez, Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` (Processes.process="* -ex*"
        AND
        Processes.process="* bypass *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `malicious_powershell_process___execution_policy_bypass_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: PowerShell local execution policy bypass attempt on $dest$
analytic_story:
    - DHS Report TA18-074A
    - Volt Typhoon
    - China-Nexus Threat Activity
    - AsyncRAT
    - HAFNIUM Group
    - Salt Typhoon
    - XWorm
    - DarkCrystal RAT
    - 0bj3ctivity Stealer
    - APT37 Rustonotto and FadeStealer
    - BlankGrabber Stealer
    - MuddyWater
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '22128.39016'
title: mshta.exe File Download
description: 'mshta.exe is a Windows utility used for executing HTML applications
  and can be abused by adversaries to download files. This use case detects executions
  of mshta.exe with URLs in the command line. LOLBINS/LOLBAS -- Threat Actor Association:
  LockBit'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "mshta.exe" | regex process="(?i)(http|ftp)s?:\/\/" | table _time,
  host, user, signature_id, process, process_*, parent_process_path, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
- defense-evasion:system binary proxy execution:mshta
technique_id:
- T1105
- T1218.005
data_category:
- PowerShell logs
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/Binaries/Mshta/
- https://www.falconguard.cz/post/top-10-lol-binaries-and-techniques-used-by-cyber-threat-actors

id: '5399.5499'
title: PSexec Service Creation
description: 'Detect creation of service for PSexec, as seen with Impackets PSexec.py
  or PSexec execution. -- Threat Actor Association: APT29, APT31, BlackMatter, DarkSide,
  Fox Kitten, Hello Kitty / Five Hands, Whisper Spider, UNC2628 -- Software Association:
  Akira, Conti, LockBit, Nefilim, Play, Rhysida, SamSam'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=7045) OR
  "<EventID>7045<")| regex Service_Start_Type!="4|disabled"| regex Service_Name!="\s+|[\_\/\x5c]"|
  regex Service_Name="(\w{4}|execsvc)$"| regex Service_File_Name="\x5c.{8}\.exe$"
  | eval service_name=Service_File_Name | table _time, host, user signature_id, user,
  dest_host, process_id, process_name, process_path, process, parent_process_id, parent_process_name,
  parent_process_path, event_id, src, service_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- execution:system services:service execution
technique_id:
- T1543.003
- T1569.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py
- https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/
- https://github.com/kavika13/RemCom
- https://github.com/malcomvetter/CSExec/tree/master/csexecsvc

name: Remote Process Instantiation via WinRM and PowerShell
id: ba24cda8-4716-11ec-8009-3e22fbd008af
version: 12
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` with arguments used to start a process on a remote endpoint via the WinRM protocol, specifically targeting the `Invoke-Command` cmdlet. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry. This activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and lateral spread within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` (Processes.process="*Invoke-Command*"
        AND
        Processes.process="*-ComputerName*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_process_instantiation_via_winrm_and_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts or users.
references:
    - https://attack.mitre.org/techniques/T1021/006/
    - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
finding:
    title: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1021.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows AI Platform DNS Query
id: 1ad89d24-c856-4a0e-8fdf-c20c7b9febe1
version: 6
creation_date: '2025-08-28'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is important because it can reveal when systems are accessing external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting such activity enables organizations to enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring provides better control over AI model usage and helps safeguard organizational data flows.
data_source:
    - Sysmon EventID 22
search: |
    `sysmon` EventCode=22 QueryName IN ("router.huggingface.co", "api.openai.com")
      | lookup update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true
      | rename dvc as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
      by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id Image
      vendor_product QueryName QueryResults QueryStatus
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
    | `windows_ai_platform_dns_query_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: researcher, engineering and administrator may create a automation that queries huggingface ai platform hub for accomplishing task.
references:
    - https://cert.gov.ua/article/6284730
    - https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a process $process_name$ made a DNS query for $query$ from host $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - LAMEHUG
    - SesameOp
    - PromptFlux
asset_type: Endpoint
mitre_attack_id:
    - T1071.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows DNS Gather Network Info
id: 347e0892-e8f3-4512-afda-dc0e3fa996f3
version: 10
creation_date: '2023-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the dnscmd.exe command to enumerate DNS records. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. This activity is significant as it may indicate an adversary gathering network information, a common precursor to more targeted attacks. If confirmed malicious, this behavior could enable attackers to map the network, identify critical assets, and plan subsequent actions, potentially leading to data exfiltration or further compromise of the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_dns_gather_network_info_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: network administrator can execute this command to enumerate DNS record. Filter or add other paths to the exclusion as needed.
references:
    - https://cert.gov.ua/article/3718487
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process commandline $process$ to enumerate dns record on $dest$
analytic_story:
    - Sandworm Tools
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1590.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows IIS Components New Module Added
id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e
version: 11
creation_date: '2022-12-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the addition of new IIS modules on a Windows IIS server. It leverages the Windows Event log - Microsoft-IIS-Configuration/Operational, specifically EventCode 29, to identify this activity. This behavior is significant because IIS modules are rarely added to production servers, and unauthorized modules could indicate malicious activity. If confirmed malicious, an attacker could use these modules to execute arbitrary code, escalate privileges, or maintain persistence within the environment, potentially compromising the server and sensitive data.
data_source:
    - Windows IIS 29
search: |-
    `iis_operational_logs` EventCode=29
      | stats  count min(_time) as firstTime max(_time) as lastTime
        BY OpCode EventCode ComputerName
           Message
      | rename ComputerName AS dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_iis_components_new_module_added_filter`
how_to_implement: You must enabled the IIS Configuration Operational log before ingesting in Splunk. Setup and inputs may be found here https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040.
known_false_positives: False positives may be present when updates or an administrator adds a new module to IIS. Monitor and filter as needed.
references:
    - https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
    - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
    - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
    - https://www.secureworks.com/research/bronze-union
    - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
    - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
finding:
    title: A new IIS Module has been loaded and should be reviewed on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - IIS Components
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1505.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Outlook Macro Security Modified
id: 47872bb4-9987-4c33-a897-4d2d1ac7d4c2
version: 4
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel, specifically looking for the registry value name "Level" with a value of "0x00000001". This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Outlook\\Security*" Registry.registry_value_name="Level" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_outlook_macro_security_modified_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: It is unusual to modify this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
    - https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
finding:
    title: Outlook Macro Security Level registry modified on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NotDoor Malware
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1137
    - T1008
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows System Reboot CommandLine
id: 97fc2b60-c8eb-4711-93f7-d26fade3686f
version: 13
creation_date: '2022-07-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic identifies the execution of the Windows command line to reboot a host machine using "shutdown.exe" with specific parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it is often associated with advanced persistent threats (APTs) and remote access trojans (RATs) like dcrat, which may use system reboots to disrupt operations, aid in system destruction, or inhibit recovery. If confirmed malicious, this could lead to system downtime, data loss, or hindered incident response efforts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name = shutdown.exe
            OR
            Processes.original_file_name = shutdown.exe
        )
        Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_system_reboot_commandline_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
references:
    - https://attack.mitre.org/techniques/T1529/
    - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
analytic_story:
    - XWorm
    - DarkGate Malware
    - NjRAT
    - Quasar RAT
    - DarkCrystal RAT
    - MoonPeak
    - Scattered Lapsus$ Hunters
    - MuddyWater
asset_type: Endpoint
mitre_attack_id:
    - T1529
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint