Splunk rules: 38

id: '6146.18230'
title: Adfind Commands
description: 'AdFind is a free command-line query tool that can be used for gathering
  information from Active Directory. In some instances Adversaries have renamed adfind
  in order to avoid detection. This use case looks for common commands of Adfind.
  -- Threat Actor Association: APT29/Nobelium/Cozy Bear, BlackMatter, Conti, DarkSide,
  FIN6, FIN7, FIN12, Karakurt, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Traveling Spider, Wizard Spider, Yanluowang -- Software
  Association: BazarLoader, Blackcat/ALPHV, Conti, DatopLoader, Dridex, Entropy, Lockbit,
  Nefilim, Quantum, Sodinokibi/REvil, Trickbot, XingLocker'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  ("objectcategory" OR "trustdmp" OR ("member" "list")) | regex process="(?i)(objectcategory|trustdmp|member\s(.*)?-list)"
  | table _time, host, user user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:domain trust discovery
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1087.002
- T1069.002
- T1482
- T1016
- T1018
data_category:
- Windows Sysmon
references:
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

id: '23090.41775'
title: AutoIt Execution
description: 'AutoIt is a freeware scripting utility that can automate Windows GUI
  tasks such as mouse clicks, keystrokes, and window manipulations. While it is a
  legitimate tool, threat actors have abused it to automate malicious activity. This
  use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3
  files. -- Software Association: DarkGate'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "AutoIT3.exe" OR "AutoIT2.exe" OR "AutoIT.exe" OR ".au3" | regex process="(?i)\S+\.exe.+\.au3"
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://isc.sans.edu/forums/diary/KPOT+Deployed+via+AutoIt+Script/25934/
- https://blog.talosintelligence.com/magnat-campaigns-use-malvertising-to/
- https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

name: Circle CI Disable Security Job
id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
version: 10
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity.
data_source:
    - CircleCI
search: |-
    `circleci`
      | rename vcs.committer_name as user vcs.subject as commit_message vcs.url as url workflows.* as *
      | stats values(job_name) as job_names
        BY workflow_id workflow_name user
           commit_message url branch
      | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job
      | search mandatory_job=*
      | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0)
      | where mandatory_job_executed=0
      | eval phase="build"
      | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `circle_ci_disable_security_job_filter`
how_to_implement: You must index CircleCI logs.
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$
analytic_story:
    - Dev Sec Ops
asset_type: CircleCI
mitre_attack_id:
    - T1554
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Cisco NVM - Browser Spawned Unix Shell with External Connection
id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41
version: 1
creation_date: '2026-09-02'
modification_date: '2026-09-02'
author: Maria Jose Erquiaga, Splunk
status: production
type: Anomaly
description: |
    Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
    This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
    The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_path IN (
        "*/bash",
        "*/csh",
        "*/dash",
        "*/fish",
        "*/sh",
        "*/tcsh",
        "*/zsh"
    )
    parent_process_path IN (
        "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin",
        "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera",
        "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox"
    )
    NOT dest IN (
            "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
            "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
            "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
            "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
            "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1"
        )

    | stats count
        min(_time) as firstTime
        max(_time) as lastTime
        values(parent_process_hash) as parent_process_hash
        values(process_hash) as process_hash
        values(module_name_list) as module_name_list
        values(module_hash_list) as module_hash_list
        values(dest_port) as dest_port
        values(dest_hostname) as dest_hostname

      by src src_ip dest dest_ip bytes_in bytes_out
         user process_id process_name process_path process
         parent_process_id parent_process_name parent_process_path parent_process

    | table
      firstTime lastTime user
      parent_process_path parent_process_name parent_process parent_process_hash
      process_path process_name process process_hash process_id
      module_name_list module_hash_list
      src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.
references:
    - https://attack.mitre.org/tactics/TA0002/
    - https://attack.mitre.org/techniques/T1059/
    - https://redcanary.com/threat-detection-report/threats/socgholish/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$].
threat_objects:
    - field: process
      type: process
    - field: dest_ip
      type: ip_address
    - field: dest_hostname
      type: domain
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1028.1029'
title: CSVDE Export Active Directory
description: 'Detects the administration tool csvde.exe attempting to export Active
  Directory data in an APT scenario. -- Threat Actor Association: Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 AND TERM(csvde)
  AND TERM(-f) | rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock
  ID.+)|^(Creating Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"
  | table _time, host, user process, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- discovery:account discovery:local account
- discovery:account discovery:domain account
technique_id:
- T1087.001
- T1087.002
data_category:
- PowerShell logs
- Process command-line parameters
references: null

name: ESXi Firewall Disabled
id: e321804c-8eb5-42f2-a843-36b289a6c6b2
version: 6
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies when the ESXi firewall is disabled or set to permissive mode, which can expose the host to unauthorized access and network-based attacks. Such changes are often a precursor to lateral movement, data exfiltration, or the installation of malicious software by a threat actor.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="*network firewall set*" AND Message="*enabled f*" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_firewall_disabled_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
finding:
    title: Firewall disabled on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
    - China-Nexus Threat Activity
asset_type: Infrastructure
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Excessive number of taskhost processes
id: f443dac2-c7cf-11eb-ab51-acde48001122
version: 12
creation_date: '2021-06-08'
modification_date: '2026-05-13'
author: Michael Hart
status: production
type: Anomaly
description: The following analytic identifies an excessive number of taskhost.exe and taskhostex.exe processes running within a short time frame. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and their counts. This behavior is significant as it is commonly associated with post-exploitation tools like Meterpreter and Koadic, which use multiple instances of these processes for actions such as discovery and lateral movement. If confirmed malicious, this activity could indicate an ongoing attack, allowing attackers to execute code, escalate privileges, or move laterally within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.user) as user values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "taskhost.exe"
        OR
        Processes.process_name = "taskhostex.exe"
      BY Processes.dest Processes.process_name _time
         span=1h
    | `drop_dm_object_name(Processes)`
    | eval pid_count=mvcount(process_id)
    | eval taskhost_count_=if(process_name == "taskhost.exe", pid_count, 0)
    | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, 0)
    | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count values(action) as action values(original_file_name) as original_file_name values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) as parent_process_path values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) as process_integrity_level values(user) as user values(process_path) as process_path values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) as process_name
      BY _time, dest, firstTime,
         lastTime
    | where taskhost_count > 10 or taskhostex_count > 10
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_number_of_taskhost_processes_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
references:
    - https://attack.mitre.org/software/S0250/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An excessive amount of taskhost.exe and taskhostex.exe was executed on $dest$ indicative of suspicious behavior.
analytic_story:
    - Meterpreter
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Possible Access Or Modification Of sshd Config File
id: 7a85eb24-72da-11ec-ac76-acde48001122
version: 11
creation_date: '2022-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects suspicious access or modification of the sshd_config file on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is significant because unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN("cat", "nano*","vim*", "vi*")
        AND
        Processes.process IN("*/etc/ssh/sshd_config")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_possible_access_or_modification_of_sshd_config_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/ssh-penetration-testing-port-22/
    - https://attack.mitre.org/techniques/T1098/004/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a commandline $process$ executed on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1098.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '1081.1131'
title: Locate Credentials
description: 'Adversaries may search local file systems and remote file shares for
  files containing passwords. These can be files created by users to store their own
  credentials, shared credential stores for a group of individuals, configuration
  files containing passwords for a system or service, or source code/binary files
  containing embedded passwords. -- Threat Actor Association: Alloy Taurus/Gallium,
  Antlion, APT15, APT29/Nobelium/Cozy Bear, DarkSide, BlackMatter, Lancyfly, Lapsus$,
  TeamTNT, Wizard Spider - Software Association: ALPHV/BlackCat, Conti, Ransom Cartel,
  Snake, TeamTNT -- Atomics 1003.002 Test #5 NOTE *Only for the Powershell version
  Atomics T1552.001 Test#1 Atomics T1552.001 Test#3 Atomics T1552.006 Test#1 Atomics
  T1552.004 Test#2'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103)
  OR TERM(EventCode=4104)) AND (TERM(findstr) AND (TERM(password) OR TERM(txt) OR
  TERM(ini) OR TERM(xml) OR TERM(pass) OR TERM(cred) OR TERM(vnc) OR TERM(config)
  OR TERM(spin) )) OR (TERM(type) AND (TERM(sysprep) OR TERM(unattend) OR TERM(Unattended))
  AND (TERM(inf) OR TERM(ini) OR TERM(xml))) OR (TERM(dir) AND (TERM(vnc) OR TERM(ultravnc))
  AND (TERM(inf) OR TERM(ini) OR TERM(xml))) OR (("cmd.exe" AND TERM(/c) AND TERM(copy))
  AND ("ntds.dit" OR "SAM" OR "System" )) OR (TERM(vssadmin) AND TERM(create) AND
  TERM(SHADOW)) OR ("ntdsutil") OR ("wmic" TERM(shadowcopy)) OR (("gwmi" OR "get-wmiobject")
  "shadowcopy") | rex field=process "(?<script>(?i)\w+.ps1") | rex field=process mode=sed
  max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock ID.+)|^(Creating Scriptblock.+)//g"
  | rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g" | table _time, host, user,
  process, process_*, script | bin span=300s | stats values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1552/001/

id: '16938.27407'
title: Potential CVE-2023-23397
description: 'Microsoft Office Outlook contains a privilege escalation vulnerability
  that allows for a NTLM Relay attack against another service to authenticate as the
  user. This use case looks for svchost spawning rundll with DavSetCookie, which may
  indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28
  (Fancy Bear, Forest Blizzard, STRONTIUM)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "svchost.exe" "rundll32" "davclnt.dll" "DavSetCookie"
  | regex process="(?i)(davclnt.dll.*DavSetCookie.*://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:process injection:dynamic-link library injection
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1048.003
- T1055.001
data_category:
- Windows event logs
references:
- https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
- https://twitter.com/aceresponder/status/1636116096506818562
- https://www.huntress.com/blog/everything-we-know-about-cve-2023-23397?utm_content=241922884&utm_medium=social&utm_source=twitter&hss_channel=tw-3330464153

id: '5026.5675'
title: Rare Process Execution
description: 'Rare process executions are anomalies within an organization and are
  normally worth looking at. Although these kinds of detections can be false positive
  prone, they can be utilized as supporting evidence or as a last resort to detect
  malicious activity your other detection content may be missing. -- Threat Actor
  Association: Traveling Spider, Volt Typhoon, Wizard Spider - Software Association:
  Conti, Nefilim, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 NOT (process_path
  IN ("C:\\Program Files*","C:\\Windows\\SoftwareDistribution\\Download\\Install\\*","C:\\ProgramData\\Microsoft\\Windows
  Defender\\platform*") OR parent_process_path IN ("C:\\Program Files*","C:\\Windows\\SoftwareDistribution\\Download\\Install\\*"))|
  rex field=process_path "^(?<process_path_ext>.+)\x5c[^\x5c]+$"| fields _time, host,
  user, process, process_*, parent_*`group_events("host, process_name", 10)` | eventstats
  dc(host) as dc_host by process_name| eventstats c(process_path_ext) as c_process_path_ext
  by process_path_ext| eventstats c(process) as c_process by process| where process_path!=parent_process_path
  and (dc_host=1 and c_process_path_ext<3 and c_process<3)`hec_collect`'
techniques:
- execution:command and scripting interpreter:windows command shell
- execution:user execution:malicious file
technique_id:
- T1204.002
- T1059.003
data_category:
- Windows Sysmon
references:
- https://www.splunk.com/en_us/blog/security/detecting-early-signs-of-compromise-using-windows-sysinternal.html
- https://d1zq5d3dtjfcoj.cloudfront.net/F-Secure-APT29-9985.png

id: '5977.18111'
title: regsvr32 Execution
description: 'Using regsvr32.exe, an adversary may load malicious .dll files. -- Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Threat Actor Association: Kimsuky,
  TA551, Traveling Spider, Wizard Spider -- Software Association: Astaroth, Bazar,
  Black Basta, Conti, HermeticWizard, IcedID, Nefilim, Qakbot/Qbot, Rhysida, XingLocker,
  Zloader Atomics T1218.010 Test#1 Atomics T1218.010 Test#2 Atomics T1218.010 Test#3
  Atomics T1218.010 Test#4 Atomics T1218.010 Test#5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(regsvr32) | regex process="(?i)(regsvr32)"| table _time, host, user parent_*,
  process, process_*, signature_id | bin span=1s | stats values(*) as * by _time,
  host | eventstats dc(process) as dc_process by host | where dc_process < 10 '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- https://www.carbonblack.com/blog/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/

name: Remcos RAT File Creation in Remcos Folder
id: 25ae862a-1ac3-11ec-94a1-acde48001122
version: 11
creation_date: '2021-09-22'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Sanjay Govind
status: production
type: TTP
description: The following analytic detects the creation of files in the Remcos folder within the AppData directory, specifically targeting keylog and clipboard log files. It leverages the Endpoint.Filesystem data model to identify .dat files created in paths containing "remcos." This activity is significant as it indicates the presence of the Remcos RAT, which performs keylogging, clipboard capturing, and audio recording. If confirmed malicious, this could lead to unauthorized data exfiltration and extensive surveillance capabilities for the attacker.
data_source:
    - Sysmon EventID 11
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") Filesystem.file_path = "*\\remcos\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US
    - https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
finding:
    title: file $file_name$ created in $file_path$ of $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1113
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '9020.12093'
title: Remote Thread from Suspicious Folder
description: 'Detects potential remote threads created from suspicious file locations
  like temp, appdata, and downloads. - Threat Actor Association: APT10/menuPass, TA413
  - Software Association: Black Basta, LOWZERO'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=8 OR "Event>ID>8<")
  ("Temporary Internet Files" OR TERM("TEMP") OR TERM("Downloads") OR TERM("Appdata"))
  | regex parent_process_path="(?i)Temp|Downloads|Appdata" | table _time, host, user
  dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id
  | bin span=1s | stats values(*) as * by _time, host, parent_process_path '
techniques:
- defense-evasion:process injection
- privilege-escalation:process injection
technique_id: 
- T1055
data_category:
- Process command-line parameters
- Windows Sysmon
references: null

id: '40420.73844'
title: Visual Studio Code Tunnel Execution
description: Adversaries may communicate using application layer protocols associated
  with web traffic to avoid detection/network filtering by blending in with existing
  traffic. Commands to the remote system, and often the results of those commands,
  will be embedded within the protocol traffic between the client and server. This
  use case detects the execution of Visual Studio Code tunnel in attempt to establish
  a C2 channel, accounting for instances where the binary has been renamed.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (".exe" "tunnel") OR (".exe" "tunnel" "--name " "--accept-server-license-terms")
  OR (" tunnel" "cmd.exe" "/d" "/c" "\servers\Stable-" "code-server.cmd") | where
  match(process, "(?i)\.exe\s+tunnel$") or (match(process, "(?i)\.exe\s+tunnel") and
  match(process, "(?i)--name\s+") and match(process, "(?i)--accept-server-license-terms"))
  or (match(parent_process, "(?i)\stunnel$") and match(process_name, "(?i)cmd\.exe")
  and match(process, "\s/d\s") and match(process, "\s/c\s") and match(process, "(?i)\x5cservers\x5cStable-")
  and match(process, "(?i)code-server\.cmd")) | table _time, host, user, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:application layer protocol:web protocols
technique_id:
- T1071.001
data_category:
- Windows Sysmon
references:
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_vscode_tunnel_execution/
- https://attack.mitre.org/techniques/T1071/001/
- https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/

id: '35597.62475'
title: WebDAV LNK Execution
description: Threat actors often place malicious payloads on remote servers, which
  are then downloaded and executed on the user’s PC using scripts or other methods.
  One type of server attackers can leverage is WebDAV (Web Distributed Authoring and
  Versioning) — a file transfer protocol built on top of HTTP. Threat actors can exploit
  this technique by creating LNK files that, when accessed through Windows Explorer,
  execute commands or scripts, enabling remote code execution and further malicious
  activities. This use case detects when a LNK file was possibly executed from a WebDAV
  server by a user who might have been tricked into accessing a URL shortcut.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "explorer.exe" ("cmd.exe" OR "cscript.exe" OR
  "mshta.exe" OR "powershell.exe" OR "pwsh.exe" OR "wscript.exe") TERM(DavWWWRoot)
  | regex parent_process_name="(?i)explorer\.exe" | regex process_name="(?i)(cmd|(c|w)script|mshta|powershell|pwsh)\.exe"|
  regex process="(?i)DavWWWRoot" | table _time, host, user, parent_*, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:user execution
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1204
- T1059.003
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1204/
- https://any.run/cybersecurity-blog/client-side-exploitation/

name: Windows Admon Group Policy Object Created
id: 69201633-30d9-48ef-b1b6-e680805f0582
version: 12
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.
data_source:
    - Windows Active Directory Admon
search: |-
    `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
      | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
        BY dcName, displayName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_admon_group_policy_object_created_filter`
how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
known_false_positives: Group Policy Objects are created as part of regular administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
    - https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
finding:
    title: A new group policy objected was created on $dcName$
    entity:
        field: dcName
        type: system
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5685.17158'
title: Windows Copy Files
description: 'Adversaries may search local system sources, such as file systems or
  local databases, or network shares to find files of interest and sensitive data
  prior to Exfiltration. Interactive command shells may be in use, and common functionality
  within cmd may be used to gather information. These events are only detected when
  a new process is created, or if powershell logging is enabled and used. Threat Actor
  Association: APT29, Evilnum, REvil, TA428, Vice Society Software Association: Black
  Basta, SamSam Atomics T1505.003 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  ("copy" OR "xcopy" OR "robocopy") | regex process="(?i)(((^|\s+)copy|(xcopy|robocopy)(\.exe)?\"?)\s+)"
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data from local system
- execution:command and scripting interpreter
- collection:data from network shared drive
technique_id: 
- T1005
- T1059
- T1039
data_category:
- Windows Sysmon
references:
- https://book.hacktricks.xyz/exfiltration
- https://www.computerhope.com/xcopyhlp.htm

name: Windows Default Group Policy Object Modified with GPME
id: eaf688b3-bb8f-454d-b105-920a862cd8cb
version: 13
creation_date: '2023-04-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects modifications to default Group Policy Objects (GPOs) using the Group Policy Management Editor (GPME). It leverages the Endpoint data model to identify processes where `mmc.exe` executes `gpme.msc` with specific GUIDs related to default GPOs. This activity is significant because default GPOs, such as the `Default Domain Controllers Policy` and `Default Domain Policy`, are critical for enforcing security policies across the domain. If malicious, such modifications could allow an attacker to gain further access, establish persistence, or deploy malware across numerous hosts, severely compromising the network's security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=mmc.exe (Processes.process =*gpme.msc*)
        AND
        (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*"
        OR
        Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*"  )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_default_group_policy_object_modified_with_gpme_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11)
finding:
    title: A default group policy object was opened with Group Policy Manage Editor on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Disable Windows Event Logging Disable HTTP Logging
id: 23fb6787-255f-4d5b-9a66-9fd7504032b5
version: 15
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of AppCmd.exe to disable HTTP logging on IIS servers. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution events where AppCmd.exe is used with specific parameters to alter logging settings. This activity is significant because disabling HTTP logging can help adversaries hide their tracks and avoid detection by removing evidence of their actions. If confirmed malicious, this could allow attackers to operate undetected, making it difficult to trace their activities and respond to the intrusion effectively.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE NOT (Processes.parent_process_name  IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe Processes.process IN ("*httplogging*","*dontlog:true*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_disable_windows_event_logging_disable_http_logging_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present only if scripts or Administrators are disabling logging. Filter as needed by parent process or other.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
    - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
    - https://www.secureworks.com/research/bronze-union
    - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable IIS HTTP Logging.
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable IIS HTTP Logging.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - IIS Components
    - CISA AA23-347A
    - Compromised Windows Host
    - Windows Defense Evasion Tactics
asset_type: Endpoint
mitre_attack_id:
    - T1505.004
    - T1685.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint