Splunk rules: 39

name: AWS Exfiltration via DataSync Task
id: 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
version: 11
creation_date: '2023-04-10'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
data_source:
    - AWS CloudTrail CreateTask
search: |-
    `cloudtrail` eventName = CreateTask eventSource="datasync.amazonaws.com"
      | rename  requestParameters.*  as *
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product destinationLocationArn
           sourceLocationArn
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_exfiltration_via_datasync_task_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS Administrator has legitimately created this task for creating backup. Please check the `sourceLocationArn` and `destinationLocationArn` of this task
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://www.shehackske.com/how-to/data-exfiltration-on-cloud-1606/
finding:
    title: DataSync task created on account id - $vendor_account$ by user $user$ from src_ip $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious AWS S3 Activities
    - Data Exfiltration
    - Hellcat Ransomware
asset_type: AWS Account
mitre_attack_id:
    - T1119
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Crowdstrike Medium Identity Risk Severity
id: c23b425c-9024-4bd7-b526-c18a4a51d93e
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects CrowdStrike alerts for Medium Identity Risk Severity with a risk score of 55 or higher. These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity and protection of sensitive information and systems.
data_source: []
search: |-
    `crowdstrike_identities` riskScoreSeverity = "MEDIUM" OR riskScore >= 0.55 AND riskScore < 0.70
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_medium_identity_risk_severity_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
finding:
    title: Medium Identity Risk Score Severity found on $domain$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Email servers sending high volume traffic to hosts
id: 7f5fb3e1-4209-4914-90db-0ec21b556378
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies a significant increase in data transfers from your email server to client hosts. It leverages the Network_Traffic data model to monitor outbound traffic from email servers, using statistical analysis to detect anomalies based on average and standard deviation metrics. This activity is significant as it may indicate a malicious actor exfiltrating data via your email server. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising sensitive information and impacting organizational security.
data_source: []
search: |-
    | tstats `security_content_summariesonly` sum(All_Traffic.bytes_out) as bytes_out FROM datamodel=Network_Traffic
      WHERE All_Traffic.src_category=email_server
      BY All_Traffic.dest_ip _time span=1d
    | `drop_dm_object_name("All_Traffic")`
    | eventstats avg(bytes_out) as avg_bytes_out stdev(bytes_out) as stdev_bytes_out
    | eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_avg_bytes_out stdev(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_stdev_bytes_out
      BY dest_ip
    | eval minimum_data_samples = 4, deviation_threshold = 3
    | where num_data_samples >= minimum_data_samples AND bytes_out > (avg_bytes_out + (deviation_threshold * stdev_bytes_out)) AND bytes_out > (per_source_avg_bytes_out + (deviation_threshold * per_source_stdev_bytes_out)) AND _time >= relative_time(now(), "@d")
    | eval num_standard_deviations_away_from_server_average = round(abs(bytes_out - avg_bytes_out) / stdev_bytes_out, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_out - per_source_avg_bytes_out) / per_source_stdev_bytes_out, 2)
    | table dest_ip, _time, bytes_out, avg_bytes_out, per_source_avg_bytes_out, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average
    | `email_servers_sending_high_volume_traffic_to_hosts_filter`
how_to_implement: This search requires you to be ingesting your network traffic and populating the Network_Traffic data model.  Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid.
known_false_positives: The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: High volume of network traffic from $dest$
analytic_story:
    - Collection and Staging
    - HAFNIUM Group
asset_type: Endpoint
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

name: F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
id: bb1c2c30-107a-4e56-a4b9-1f7022867bfe
version: 10
creation_date: '2022-05-10'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects attempts to exploit the F5 BIG-IP iControl REST API vulnerability (CVE-2022-1388) for unauthenticated remote code execution.
    It identifies suspicious URI paths and POST HTTP methods, along with specific request headers containing potential commands in the `utilcmdargs` field and a random base64 encoded value in the `X-F5-Auth-Token` field.
    This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary commands on the affected system.
    If confirmed malicious, this could lead to full system compromise and unauthorized access to sensitive data.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
             count min(_time) as firstTime
                   max(_time) as lastTime
    FROM datamodel=Web WHERE
    Web.url="*/mgmt/tm/util/bash*"
    Web.http_method="POST"
    BY Web.http_user_agent Web.http_method
       Web.url Web.url_length
       Web.src Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
known_false_positives: |
    False positives may be present if the activity is blocked or was not successful. Filter known vulnerability scanners. Filter as needed.
references:
    - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml
    - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
    - https://twitter.com/da_667/status/1523770267327250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ
    - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py
finding:
    title: An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - F5 BIG-IP Vulnerability CVE-2022-1388
    - CISA AA24-241A
asset_type: Web Server
cve:
    - CVE-2022-1388
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

id: '44122.86351'
title: FScan.exe Network Scan
description: Threat actors may use fscan, an open-source security scanning tool, to
  perform network reconnaissance, identify open ports, and detect vulnerabilities
  within a target environment. When executed, fscan often leverages rapid ICMP pings
  to scan private IP ranges for live hosts. This use case detects internal network
  scans by identifying hosts that generate over 100 rapid ICMP ping requests to private
  IP addresses matching fscan's automated command style within a grouped event window
  (default 30s), which may indicate unauthorized network scanning activity from fscan
  or similar utilities.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(ping) "-n" "-w" | where match(process, "(?i)ping\s+-n\s1\s-w\s1\s(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3})")
  | table _time, host, user, host, process*, parent* | bin span=30s | stats values(*)
  as * by _time, host | where event_count > 100 '
techniques:
- discovery:remote system discovery
- discovery:network service discovery
technique_id: 
- T1018
- T1046
data_category:
- Windows Sysmon
references:
- https://github.com/shadow1ng/fscan
- https://blog.talosintelligence.com/new-persistent-attacks-japan/

name: GCP Kubernetes cluster pod scan detection
id: 19b53215-4a16-405b-8087-9e6acf619842
version: 8
creation_date: '2020-07-17'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: experimental
type: Hunting
description: The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.
data_source: []
search: |-
    `google_gcp_pubsub_message` category=kube-audit
      | spath input=properties.log
      | search responseStatus.code=401
      | table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod
      | `gcp_kubernetes_cluster_pod_scan_detection_filter`
how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
known_false_positives: Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods  will provide context.
references: []
analytic_story:
    - Kubernetes Scanning Activity
    - Scattered Lapsus$ Hunters
asset_type: GCP Kubernetes cluster
mitre_attack_id:
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: GetCurrent User with PowerShell
id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
version: 8
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use this method to identify the logged-in user on a compromised endpoint, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this could allow attackers to gain insights into user context, potentially facilitating further exploitation and lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="powershell.exe"
        )
        (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `getcurrent_user_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1033/
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1033
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Kubernetes Abuse of Secret by Unusual User Agent
id: 096ab390-05ca-462c-884e-343acd5b9240
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects unauthorized access or misuse of Kubernetes Secrets by unusual user agents. It leverages Kubernetes Audit logs to identify anomalies in access patterns by analyzing the source of requests based on user agents. This activity is significant for a SOC because Kubernetes Secrets store sensitive information like passwords, OAuth tokens, and SSH keys, making them critical assets. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, potentially resulting in significant security breaches and exfiltration of critical information.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` objectRef.resource=secrets verb=get
      | search NOT `kube_allowed_user_agents`
      | fillnull
      | stats count
        BY objectRef.name objectRef.namespace objectRef.resource
           requestReceivedTimestamp requestURI responseStatus.code
           sourceIPs{} stage user.groups{}
           user.uid user.username userAgent
           verb
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_abuse_of_secret_by_unusual_user_agent_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Access of Kubernetes secret $objectRef.name$ from unusual user agent $userAgent$ by $user$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1552.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Auditd Sudo Or Su Execution
id: 817a5c89-5b92-4818-a22d-aa35e1361afe
version: 10
creation_date: '2024-08-09'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd`  proctitle IN ("*sudo *", "*su *")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_sudo_or_su_execution_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1548/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to execute the sudo or su command.
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Shell History Access Via Command Line Utility
id: 0e4c2544-b27a-4a2d-b9be-cac8efe515fb
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.).
    A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system.
    A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name IN (
        "cat",
        "fmt",
        "head",
        "less",
        "more",
        "nano",
        "sort",
        "tail",
        "uniq",
        "vi",
        "vim"
    )
    Processes.process IN (
        "*.bash_history*",
        "*.history*",
        "*.sh_history*",
        "*.zhistory*",
        "*.zsh_history*",
        "*fish_history*"
    )

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest
       Processes.process_current_directory Processes.process_path Processes.process_integrity_level
       Processes.original_file_name Processes.parent_process Processes.parent_process_path
       Processes.parent_process_guid Processes.parent_process_id Processes.process_guid
       Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_shell_history_access_via_command_line_utility_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment.
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$].
        - field: user
          type: user
          score: 20
          message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$].
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Linux Post-Exploitation
    - Compromised Linux Host
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Credential Dumping
asset_type: Endpoint
mitre_attack_id:
    - T1552.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Suspicious XDG Autostart
id: dc057fd6-34db-4c41-b8dd-00463c47bf83
version: 1
creation_date: '2026-07-08'
modification_date: '2026-07-08'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths.
    Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session.
    This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime max(_time) as lastTime

    FROM datamodel=Endpoint.Filesystem WHERE

    Filesystem.action="created"
    Filesystem.file_path IN (
        "/etc/xdg/autostart/*",
        "*/.config/autostart/*"
    )
    Filesystem.file_path = "*.desktop"

    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.process_guid
       Filesystem.process_id Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_suspicious_xdg_autostart_filter`
how_to_implement: |-
    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: |-
    Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed.
references:
    - https://github.com/Aegrah/PANIX
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible Suspicious XDG Autostart file created under [$file_path$] by [$user$] on [$dest$]
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Linux Persistence Techniques
    - Linux Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1547
    - T1037
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS AMOS Stealer - Virtual Machine Check Activity
id: 4e41ad21-9761-426d-8aa1-083712ff9f30
version: 7
creation_date: '2025-04-25'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Alex Karkins
status: production
type: Anomaly
description: |
    The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings.
    This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not.
    If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.
data_source:
    - Osquery Results
search: |
    `osquery_macro`
    name=es_process_events
    columns.cmdline="*osascript*"
    columns.cmdline="* -e *"
    columns.cmdline="*set*"
    columns.cmdline="*system_profiler*"
    columns.cmdline IN ("*VMware*", "*QEMU*")

    | rename columns.* as *

    | stats  min(_time) as firstTime max(_time) as lastTime
      values(cmdline) as cmdline,
      values(pid) as pid,
      values(parent) as parent,
      values(path) as path,
      values(signing_id) as signing_id,
      by username host

    | rename
      username as user,
      cmdline as process,
      parent as parent_process,
      path as process_path,
      host as dest

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_amos_stealer___virtual_machine_check_activity_filter`
how_to_implement: |
    This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: No false positives have been identified at this time.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://www.virustotal.com/gui/search/behaviour_processes%253A%2522osascript%2520-e%2520set%2522%2520AND%2520behaviour_processes%253A%2522system_profiler%2522%2520AND%2520(behaviour_processes%253A%2522VMware%2522%2520OR%2520behaviour_processes%253A%2522QEMU%2522)?type=files
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: AMOS Stealer activity on host $dest$ by user $user$
        - field: dest
          type: system
          score: 20
          message: AMOS Stealer activity on host $dest$ by user $user$
analytic_story:
    - AMOS Stealer
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1059.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '24144.44688'
title: MSIExec.exe Execution
description: msiexec.exe is a Windows system component used to install and modify
  software packages using Windows Installer. Threat actors may abuse msiexec.exe to
  install malicious software or execute scripts, leveraging its legitimate appearance
  to bypass security measures and gain persistence on a targeted system as observed
  in FlawedGrace attacks. This use case detects any execution of msiexec.exe. Living
  Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(msiexec) OR "msiexec.exe" | regex process_name="(?i)msiexec\.exe"
  | table _time, host, user process, process_*, parent_process_name, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/

name: Nginx ConnectWise ScreenConnect Authentication Bypass
id: b3f7a803-e802-448b-8eb2-e796b223bccc
version: 11
creation_date: '2024-02-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via alternate paths or channels. It leverages Nginx access logs to identify web requests to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected ScreenConnect instance, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
data_source:
    - Nginx Access
search: |-
    `nginx_access_logs` uri_path IN ("*/SetupWizard.aspx/*","*/SetupWizard/") status=200 http_method=POST
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY src, dest, http_user_agent,
           url, uri_path, status,
           http_method, sourcetype, source
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `nginx_connectwise_screenconnect_authentication_bypass_filter`
how_to_implement: To implement this analytic, ensure proper logging is occurring with Nginx, access.log and error.log, and that these logs are being ingested into Splunk. STRT utilizes this nginx.conf https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec to properly log as much data with Nginx.
known_false_positives: False positives are not expected, as the detection is based on the presence of web requests to the SetupWizard.aspx page, which is not a common page to be accessed by legitimate users. Note that the analytic is limited to HTTP POST and a status of 200 to reduce false positives. Modify the query as needed to reduce false positives or hunt for additional indicators of compromise.
references:
    - https://docs.splunk.com/Documentation/AddOns/released/NGINX/Sourcetypes
    - https://gist.github.com/MHaggis/26f59108b04da8f1d870c9cc3a3c8eec
    - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
    - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
    - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
finding:
    title: An authentication bypass attempt against ScreenConnect has been detected on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ConnectWise ScreenConnect Vulnerabilities
    - Seashell Blizzard
    - Scattered Lapsus$ Hunters
    - Hellcat Ransomware
asset_type: Web Proxy
cve:
    - CVE-2024-1708
    - CVE-2024-1709
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '5343.5722'
title: 'Remote Admin Tools  '
description: 'PsExec, RemCom, PaExec, and CsExec are administrative command-line utilities
  that allow remote command execution Threat Actor Association: Antlion, DarkSide,
  BlackMatter, APT29/Nobelium, APT31, Carbanak, FIN6, FIN7, FIN8, FIN12, Fox Kitten,
  GoldenJackal, Hello Kitty / Five Hands, MalKamak, Muddled Libra, OilRig, Traveling
  Spider, UNC2596, Vice Society, Wizard Spider - Software Association: ALPHV/BlackCat,
  AvosLocker, BianLian, Blackbyte, Blacksuit, Black Basta, Conti, Cuba, GhostShell,
  Lockbit, Play, Prometheus/Spook, Prestige, PYSA/Mespinoza, Quantum, Rhysida, Royal,
  Vice Society - Atomics T1021.002 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ".exe" "\\\\"|
  regex process="(\.exe(\")?\s+|\/c.{1,}?)\x5c\x5c.{2,}" | table _time, host, user
  process, process_*, parent_process, parent_process_*, src_user | bin span=1s | stats
  values(*) as * by _time, host, process `hec_collect`'
techniques:
- execution:system services:service execution
- lateral-movement:remote services
- execution:command and scripting interpreter:windows command shell
- lateral-movement:lateral tool transfer
technique_id:
- T1569.002
- T1021
- T1059.003
- T1570
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/

id: '22624.40798'
title: Remote Share Directory Listing - Windows
description: 'Threat actors may seek to enumerate local administrative access on remote
  systems during reconnaissance activities. This use case detects commands to list
  files and directories on administrative shares (C$, Admin$, or IPC$). Note: dir
  and tree commands do not generate process creation logs and will only be detected
  if called with another executable, e.g. "cmd.exe /c dir".'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(dir) OR TERM(ls) OR TERM(Get-ChildItem)
  OR TERM(gci) OR TERM(tree)) ("C$" OR "ADMIN$" OR "IPC$") | regex process="(?i)\x5c\x5c(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\x5c(C|ADMIN|IPC)\$"
  | table _time, host, user user, process, process_*, parent_process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- discovery:file and directory discovery
technique_id: 
- T1083
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/

name: SilentCleanup UAC Bypass
id: 56d7cfcc-da63-11eb-92d4-acde48001122
version: 14
creation_date: '2021-07-08'
modification_date: '2026-05-13'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\\Environment\\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/hfiref0x/UACME
    - https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
finding:
    title: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
    - MoonPeak
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Wermgr Process Connecting To IP Check Web Services
id: ed313326-a0f9-11eb-a89c-acde48001122
version: 14
creation_date: '2021-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the wermgr.exe process attempting to connect to known IP check web services. It leverages Sysmon EventCode 22 to identify DNS queries made by wermgr.exe to specific IP check services. This activity is significant because wermgr.exe is typically used for Windows error reporting, and its connection to these services may indicate malicious code injection, often associated with malware like Trickbot. If confirmed malicious, this behavior could allow attackers to recon the infected machine's IP address, aiding in further exploitation and evasion tactics.
data_source:
    - Sysmon EventID 22
search: |-
    `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
      | stats  min(_time) as firstTime max(_time) as lastTime count
        BY answer answer_count dvc
           process_exec process_guid process_name
           query query_count reply_code_id
           signature signature_id src
           user_id vendor_product QueryName
           QueryResults QueryStatus
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `wermgr_process_connecting_to_ip_check_web_services_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://labs.vipre.com/trickbot-and-its-modules/
    - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/
finding:
    title: Wermgr.exe process connecting IP location web services on $dvc$
    entity:
        field: dvc
        type: system
        score: 50
analytic_story:
    - Trickbot
asset_type: Endpoint
mitre_attack_id:
    - T1590.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

name: Windows BitDefender Submission Wizard DLL Sideloading
id: a1b2c3d4-e5f6-4789-a012-3456789abcde
version: 3
creation_date: '2026-03-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: |
    Detects DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) when a malicious log.dll is loaded from a non-standard path via Sysmon ImageLoad events.
data_source:
    - Sysmon EventID 7
search: |-
    `sysmon`
    EventCode=7
    (
        Image IN (
            "*\\BDSubmit.exe",
            "*\\bdsw.exe",
            "*\\BluetoothService.exe"
        )
        OR
        OriginalFileName IN (
            "BDSubmit.exe",
            "bdsw.exe"
        )
    )
    ImageLoaded="*\\log.dll"
    NOT ImageLoaded IN (
        "*:\\Program Files (x86)\\*",
        "*:\\Program Files\\*",
        "*:\\Windows\\System32\\*",
        "*:\\Windows\\SysWOW64\\*"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest Image ImageLoaded Signed SignatureStatus User OriginalFileName loaded_file
         loaded_file_path process_exec process_guid process_hash process_id process_name
         process_path service_dll_signature_exists service_dll_signature_verified signature
         signature_id user_id vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_bitdefender_submission_wizard_dll_sideloading_filter`
how_to_implement: |
    Ingest Sysmon ImageLoad events and ensure the Splunk Add-on for Sysmon is configured to parse them. Enable ImageLoad in Sysmon config for DLLs. Map logs to Endpoint data model where applicable.
known_false_positives: |
    Legitimate Bitdefender installations loading log.dll from Program Files are excluded. Allowlist known paths as needed.
references:
    - https://attack.mitre.org/techniques/T1574/002/
    - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
    - https://attack.mitre.org/groups/G0065/
finding:
    title: Bitdefender Submission Wizard loaded $ImageLoaded$ from a non-standard path on $dest$ by user $User$, indicating potential DLL side-loading activity.
    entity:
        field: User
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Bitdefender Submission Wizard loaded $ImageLoaded$ from a non-standard path on $dest$ by user $User$, indicating potential DLL side-loading activity.
threat_objects:
    - field: Image
      type: process_name
    - field: ImageLoaded
      type: file_name
analytic_story:
    - Lotus Blossom Chrysalis Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1574
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Defacement Modify Transcodedwallpaper File
id: e11c3d90-5bc7-42ad-94cd-ba75db10d897
version: 10
creation_date: '2022-09-05'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies modifications to the TranscodedWallpaper file in the wallpaper theme directory, excluding changes made by explorer.exe. This detection leverages the Endpoint.Processes and Endpoint.Filesystem data models to correlate process activity with file modifications. This activity is significant as it may indicate an adversary attempting to deface or change the desktop wallpaper of a targeted host, a tactic often used to signal compromise or deliver a message. If confirmed malicious, this could be a sign of unauthorized access and tampering, potentially leading to further system compromise or data exfiltration.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: 3rd part software application can change the wallpaper. Filter is needed.
references:
    - https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US
    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: modification or creation of transcodedwallpaper file by $process_name$ on $dest$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Brute Ratel C4
asset_type: Endpoint
mitre_attack_id:
    - T1491
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Utilize ProgIDs
id: 64fa82dd-fd11-472a-9e94-c221fffa591d
version: 11
creation_date: '2024-09-18'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects modifications to the Windows Registry specifically targeting Programmatic Identifier associations to bypass User Account Control (UAC) Windows OS feature. ValleyRAT may create or alter registry entries to targetted progIDs like `.pwn` files with malicious processes, allowing it to execute harmful scripts or commands when these files are opened. By monitoring for unusual changes in registry keys linked to ProgIDs, this detection enables security analysts to identify potential threats like ValleyRAT execution attempts. Early detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape
    - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers
    - https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A possible ValleyRAT Registry modification in [$dest$].
        - field: dest
          type: system
          score: 20
          message: A possible ValleyRAT Registry modification in [$dest$].
analytic_story:
    - ValleyRAT
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process Execution From ProgramData
id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0
version: 10
creation_date: '2021-05-07'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |
    The following analytic identifies processes running from file paths within
    the ProgramData directory, a common location abused by adversaries for executing
    malicious code while evading detection. Threat actors often drop and execute payloads
    from this directory to bypass security controls, as it typically has write permissions
    for standard users. While this behavior can indicate malware execution or persistence
    techniques, it is important to note that some legitimate software, installers, and
    update mechanisms also run from ProgramData, leading to potential false positives.
    Security teams should validate detections by correlating with other indicators,
    such as unusual parent processes, unsigned binaries, or anomalous network activity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count values(Processes.process_name)
    as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where

    Processes.process_path = "*:\\ProgramData\\*"

    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
    Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
    Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
    Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
    Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_process_execution_from_programdata_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - StealC Stealer
    - SnappyBee
    - XWorm
    - Salt Typhoon
    - China-Nexus Threat Activity
    - APT37 Rustonotto and FadeStealer
    - GhostRedirector IIS Module and Rungan Backdoor
    - Axios Supply Chain Post Compromise
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1036.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint