Splunk rules: 3a

id: '5986.6348'
title: Access Common Package Config file
description: 'Adversaries may establish persistence and/or elevate privileges using
  system mechanisms that trigger execution based on specific events. An Adversary
  with access could identify or modify configuration of packages in order to execute
  code and evade defenses. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(vi)
  OR TERM(vim) OR TERM(nano) OR TERM(visudo) OR TERM(edit) OR (TERM(copy) TERM(con))
  OR TERM(cat) OR TERM(more) OR TERM(gc) OR TERM(get-Content) OR TERM(type) OR ">>"
  OR ">") ("requirements.txt" OR "pip.conf" OR "package.json" OR "gemspec" OR "gemrc")
  | regex process="(?i)(vi|vim|nano|visudo|edit|copy\s+con|cat|more|gc|get-content|type|\>\>|\>)\s+.+(requirements\.txt|pip\.conf|package.json|\.gemspec|gemrc)"
  | table _time, host, user, process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- persistence:event triggered execution
- privilege-escalation:event triggered execution
technique_id: 
- T1546
data_category:
- Process command-line parameters
- PowerShell logs
references:
- https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

id: '1035.1044'
title: Common Reconnaissance Commands
description: 'These are reconnaissance commands that are most commonly used by attackers
  in order to collect information after gaining a access to the machine. -- Threat
  Actor Association: AbcBot, Alloy Taurus/Gallium, Andariel, APT27/Emissary Panda,
  APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, APT35/Phosphorus/Magic Hound, APT36, APT43, Carbanak,
  FamousSparrow, FIN6, FIN7, FIN8, FIN12, FIN13, Gorgon Group, Kimsuky, MuddyWater,
  OilRig, SaintBear (aka UAC-0056, UNC2589, TA471), TA428, TA2541, TRAVELING SPIDER,
  UAC-0056, Volt Typhoon (Bronze Silhouette, Vanguard Panda), Winter Vivern, Wizard
  Spider -- Software Association: AvosLocker, BadHatch, Bazarloader, BianLian, Black
  Basta, Blackcat/ALPHV, Clop, Conti, Cyclops Blink, Emotet, GhostShell, Hancitor,
  Havex, IcedID, Insekt, Lockbit, NanoCore, Nefilim, PowerShortShell, Prometheus /
  Spook, PYSA/Mespinoza, QakBot, Remcos, Ryuk, Snatch, Sodinokibi/REvil, Trickbot,
  Vice Society, XingLocker -- Atomics T1007 Test#1 Atomics T1007 Test#2 Atomics T1016
  Test#1 Atomics T1016 Test#2 Atomics T1016 Test#3 Atomics T1016 Test#4 Atomics T1016
  Test#7 Atomics T1018 Test#1 Atomics T1018 Test#2 Atomics T1018 Test#3 Atomics T1018
  Test#5 Atomics T1018 Test#6 Atomics T1018 Test#8 Atomics T1518.001 Test#1 Atomics
  T1571 Test#1 Atomics T1033 Test #1 Atomics T1087.001 Test #4 Atomics T1087.001 Test
  #5 Atomics T1087.001 Test #6 Atomics T1087.001 Test #7 Atomics T1087.001 Test #8
  Atomics T1087.001 Test #9 Atomics T1087.001 Test #10 Atomics T1201 Test #5 Atomics
  T1201 Test #6'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ( "whoami.exe"
  OR "systeminfo.exe" OR "HOSTNAME.EXE" OR "ipconfig.exe" OR "route.exe" OR "arp.exe"
  OR "netstat.exe" OR "netsh.exe" OR "tasklist.exe" OR "driverquery.exe" OR "qprocess.exe"
  OR "query.exe" OR "nslookup.exe" OR "tracert.exe" OR "net.exe" OR "cmdkey.exe")
  | where match(parent_process_name,"(?i)(powershell\.exe)|(cmd\.exe)") AND (match(process,"(?i)((whoami)|(dir)|(hostname)|(hostname)|(systeminfo)|(ipconfig)|(route)|(arp)|(cmdkey))($|\s)")
  OR match(process,"(?i)((netstat)|(netsh)|(schtasks)|(tasklist)|(driverquery)|(qprocess)|(nslookup))($|\s)")
  OR match(process,"(?i)((tracert)|(query)|(net\s+((localgroup)|(group)|(config)|(share)|(use)|(user)|(view))))($|\s)"))
  | table _time, host, user process, process_*, parent_process, parent_process_* |
  bin span=60s | stats values(*) as * by _time, host,user | streamstats dc(process_name)
  as dc_process_name by _time, host | where dc_process_name>2 `hec_collect`'
techniques:
- discovery:system owner/user discovery
- execution:command and scripting interpreter
- discovery:account discovery:local account
- discovery:process discovery
- discovery:system information discovery
- discovery:system service discovery
- execution:command and scripting interpreter:unix shell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1033
- T1059
- T1087.001
- T1057
- T1082
- T1007
- T1059.003
- T1059.004
data_category:
- Windows Sysmon
references:
- https://capec.mitre.org/data/definitions/577.html
- https://www.programmersought.com/article/71384528057/

id: '22209.39128'
title: Domain Trust Discovery Commands - Windows
description: 'Adversaries may attempt to gather information on domain trust relationships
  that may be used to identify lateral movement opportunities in Windows multi-domain/forest
  environments. This use case detects executions of domain trust discovery commands
  used with nltest.exe. nltest.exe is not included in the detection to account for
  instances where nltest.exe has been renamed. -- Software Association: Play -- Atomics
  T1482 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1 OR "<EventID>1<")
  ("/domain_trusts" OR "/trusted_domains") | table _time, host, user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:domain trust discovery
technique_id: 
- T1482
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest

name: Kubernetes Access Scanning
id: 2f4abe6d-5991-464d-8216-f90f42999764
version: 10
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects potential scanning activities within a Kubernetes environment. It identifies unauthorized access attempts, probing of public APIs, or attempts to exploit known vulnerabilities by monitoring Kubernetes audit logs for repeated failed access attempts or unusual API requests. This activity is significant for a SOC as it may indicate an attacker's preliminary reconnaissance to gather information about the system. If confirmed malicious, this activity could lead to unauthorized access to sensitive systems or data, posing a severe security risk.
data_source:
    - Kubernetes Audit
search: |-
    `kube_audit` "user.groups{}"="system:unauthenticated" "responseStatus.code"=403
      | iplocation sourceIPs{}
      | stats count values(userAgent) as userAgent values(user.username) as user.username values(user.groups{}) as user.groups{} values(verb) as verb values(requestURI) as requestURI values(responseStatus.code) as responseStatus.code values(responseStatus.message) as responseStatus.message values(responseStatus.reason) as responseStatus.reason values(responseStatus.status) as responseStatus.status
        BY sourceIPs{} Country City
      | where count > 5
      | rename sourceIPs{} as src_ip, user.username as user
      | `kubernetes_access_scanning_filter`
how_to_implement: The detection is based on data that originates from Kubernetes Audit logs. Ensure that audit logging is enabled in your Kubernetes cluster. Kubernetes audit logs provide a record of the requests made to the Kubernetes API server, which is crucial for monitoring and detecting suspicious activities. Configure the audit policy in Kubernetes to determine what kind of activities are logged. This is done by creating an Audit Policy and providing it to the API server. Use the Splunk OpenTelemetry Collector for Kubernetes to collect the logs. This doc will describe how to collect the audit log file https://github.com/signalfx/splunk-otel-collector-chart/blob/main/docs/migration-from-sck.md. When you want to use this detection with AWS EKS, you need to enable EKS control plane logging https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html. Then you can collect the logs from Cloudwatch using the AWS TA https://splunk.github.io/splunk-add-on-for-amazon-web-services/CloudWatchLogs/.
known_false_positives: No false positives have been identified at this time.
references:
    - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Kubernetes scanning from ip $src_ip$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Kubernetes Security
asset_type: Kubernetes
mitre_attack_id:
    - T1046
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Linux Node Privilege Escalation
id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce
version: 13
creation_date: '2022-08-02'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic identifies the execution of Node.js with elevated privileges using sudo, specifically when spawning child processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific Node.js commands. This activity is significant because running Node.js as a superuser without dropping privileges can allow unauthorized access to the file system and potential privilege escalation. If confirmed malicious, this could enable an attacker to maintain privileged access, execute arbitrary code, and compromise sensitive data within the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*sudo*node*"
        AND
        Processes.process="*-e*"
        AND
        Processes.process="*child_process.spawn*"
        AND
        Processes.process="*stdio*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_node_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/docker/
    - https://en.wikipedia.org/wiki/Node.js
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6847.8063'
title: Msiexec Abuse
description: 'Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
  Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly
  associated with executing installation packages (.msi). This use case looks for
  msiexec launching filetypes other than ".msi" Software Association: Raspberry Robin,
  Zloader Atomics T1218.007 Test #9 Atomics T1218.007 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) TERM(msiexec) NOT ".msi" | regex process="(?i)msiexec.*?\.\w{2,5}"| table _time,
  host, user parent_*, process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host | eventstats dc(process) as dc_process by host | where dc_process
  < 10 '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://lolbas-project.github.io/lolbas/Binaries/Msiexec/

name: O365 ZAP Activity Detection
id: 4df275fd-a0e5-4246-8b92-d3201edaef7a
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. This capability is an enhanced protection feature that retro-actively removes email with known malicious content for user inboxes. Since this is a retroactive capability, there is still a window in which the user may fall victim to the malicious content.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AlertEntityGenerated Name="*messages containing malicious*"
      | fromjson Data
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime values(zu) as url values(zfn) as file_name values(ms) as subject values(ttr) as result values(tsd) as src_user
        BY AlertId,trc,signature,Name,dest,src,vendor_account,vendor_product
      | rename Name as signature, AlertId as signature_id, trc as user
      | eval action = CASE(match(result,"Success"), "blocked", true(),"allowed"), url = split(url,";")
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_zap_activity_detection_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Some features of Zero-hour purge are only offered within E3/E5 license level tenants, events may not be available otherwise.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ was included in a ZAP protection activity.
threat_objects:
    - field: file_name
      type: file_name
    - field: src_user
      type: email_address
    - field: url
      type: url
analytic_story:
    - Spearphishing Attachments
    - Suspicious Emails
asset_type: O365 Tenant
mitre_attack_id:
    - T1566.001
    - T1566.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '24625.45522'
title: Permissions Replaced by icacls - Windows
description: 'icacls is a command-line utility in Windows that allows for viewing
  and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat
  actors may abuse this tool to alter file permissions, potentially gaining unauthorized
  access or control over sensitive files and directories, as observed by DFIR report
  (see references). This use case detects icacls executions with switches to replace
  permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "icacls" ("/grant:" OR "/deny:" OR "/remove:" OR "/setintegritylevel:" OR "/inheritance:")
  | rex field=_raw "(?<=icacls\.exe\"\s)(?<file_path>[^\s]+)"| rex field=_raw "/(grant|deny|remove|setintegritylevel|inheritance):\S\s(?<permission_user>[^\:]+):F"|
  table _time, host, user, process, process_*, parent_process, parent_process_*, user,
  file_path, permission_user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222
- T1222.001
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '32266.57401'
title: Potential AutoHotkey .ahk Execution
description: Adversaries may execute commands and perform malicious tasks using AutoIT
  and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages
  that enable users to automate Windows tasks. These automation scripts can be used
  to perform a wide variety of actions, such as clicking on buttons, entering text,
  and opening and closing programs. This use case detects exeuction of .ahk files,
  accounting for renamed AutoHotkey binaries. Due to the broad nature of this rule,
  false positives for .ahk creation are expected. Allowlisting for expected executables
  and command line arguments is recommended.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ".ahk" | regex process="(?i)\.exe.+\S+\.ahk(\s|$|\")"
  | table _time, host, user, process, parent_process_name, process_name, process_path
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1059/010/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_renamed_autohotkey/
- https://www.autohotkey.com/

id: '33131.58750'
title: Potential EternalBlue via Metasploit
description: Adversaries may use Valid Accounts to interact with a remote network
  share using Server Message Block (SMB). The adversary may then perform actions as
  the logged-on user. This use case detects attempts to authenticate to an SMB share
  using Metasploit-Framework's EternalBlue module. False positives may be generated
  for workstations using 16-character alphanumeric naming conventions; allowlisting
  specific hostnames following this naming convention is recommended for best fidelity.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4625) OR
  "<EventID>4625<") OR (TERM(EventCode=4624) OR "<EventID>4624<") AND AuthenticationPackageName=NTLM
  AND LogonType=3) OR (TERM(EventCode=4776) OR "<EventID>4776<") | regex Source_Workstation="^[A-Za-z0-9]{16}$"
  | table _time, host, user, src, src_*, dest, dest_*, Source_Workstation, signature_id,
  AuthenticationPackageName, LogonType, | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://attack.mitre.org/techniques/T1021/002/
- https://github.com/rapid7/metasploit-framework/tree/master
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_metasploit_authentication.yml

name: Remote Process Instantiation via DCOM and PowerShell
id: d4f42098-4680-11ec-ad07-3e22fbd008af
version: 13
creation_date: '2021-11-15'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` with arguments used to start a process on a remote endpoint by abusing the DCOM protocol, specifically targeting ShellExecute and ExecuteShellCommand. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant as it indicates potential lateral movement and remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, escalate privileges, and move laterally within the network, posing a severe security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*"
        OR
        Processes.process="*Document.Application.ShellExecute*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `remote_process_instantiation_via_dcom_and_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
references:
    - https://attack.mitre.org/techniques/T1021/003/
    - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
finding:
    title: A process was started on a remote endpoint from $dest$ by abusing DCOM using PowerShell.exe
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Lateral Movement
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1021.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5851.6130'
title: Rundll32 Command Line
description: 'Adversaries may abuse rundll32.exe to proxy execution of malicious code.
  Using rundll32.exe, may avoid triggering security tools that may not monitor execution
  of the rundll32.exe process because of allowlists or false positives from normal
  operations. Rundll32.exe is commonly associated with executing DLL payloads. This
  use case specifically looks for command line argument executions with rundll32.
  -- Threat Actor Association: Alloy Taurus/Gallium, APT-K-47/Mysterious Elephant,
  APT29/Nobelium/Cozy Bear, APT35/Phosphorus/Magic Hound, FIN7, MuddyWater, Night
  Spider, TA413, TA551, Witchetty, Wizard Spider - Software Association: ALPHV/BlackCat,
  Bazar, Black Basta, Clop, Conti, Hancitor, HermeticWizard, Hive, IcedID, LOWZERO,
  MINEBRIDGE, PowerShortShell, PYSA/Mespinoza, Quantum, Qakbot/Qbot, Ransom Cartel,
  RATDispenser, Rhysida, Sodinokibi/REvil, SquirrelWaffle, Trickbot, XingLocker --
  Atomics T1218.011 Test#1 Atomics T1218.011 Test#2 Atomics T1218.011 Test#3 Atomics
  T1218.011 Test#4 Atomics T1218.011 Test#5 Atomics T1218.011 Test#6 Atomics T1218.011
  Test#7 Atomics T1218.011 Test#8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(EventCode=4103)) ("rundll32.exe" OR "rundll32") | rex field=_raw (?<process_msg>"(?i)rundll32.{1,40}")
  | table _time, host, user process, process_name, signature_id, process_msg | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- PowerShell logs
references:
- https://redcanary.com/threat-detection-report/techniques/rundll32/

name: Splunk RCE Through Arbitrary File Write to Windows System Root
id: c97e0704-d9c6-454d-89ba-1510a987bf72
version: 7
creation_date: '2024-10-14'
modification_date: '2026-06-23'
author: Rod Soto
status: production
type: Hunting
description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power”  Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration
data_source:
    - Splunk
search: |-
    ```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created```
    `splunkda` status=200 uri_path="*/search/apps/local/_new"
    | bin _time span=1m | stats count by _time, user
    ``` A request to this endpoint also results in an ApplicationManager event showing that a new application was created. This exposes the name and is created immediately following the initial request.  We will look for these creation messages up to 60 seconds after the request to the vulnerable endpoint.```
    | eval earliest_app_creation_time=_time
    | eval latest_app_creation_time=_time+60
    | eval api_user=user
    ```Search for the names of apps that were created with the time bounds above```
    | map maxsearches=150 search="search index=_internal earliest=$earliest_app_creation_time$ latest=$latest_app_creation_time$
    ```Admins, or users with app creation privileges may abuse this command```
    (sourcetype=splunkd component=ApplicationManager event_message=\"Detected app creation:*\") OR
    ```But the command may also be abused by users with lower privileges```
    (sourcetype=splunk_python user=$api_user$ type=ERROR \"requires capability\" AND (\"edit_local_apps\" OR \"admin_all_objects\"))
    ```Create meaningful messages in the case that app creation was successful or if it failed```
    | strcat event_message \" - This app should be examined to ensure that it is legitimate.\" message_if_app_creation_successful
    | strcat event_message \"Detected failed app creation: user does not have admin_all_objects or edit_local_apps capability and the user account MUST be investigated. This may still have resulted in the upload of malicious file(s) or execution of maliciouis command(s).\" message_if_app_creation_failed
    | eval message=if(isnull(event_message), message_if_app_creation_failed, message_if_app_creation_successful )
    | eval user=\"$api_user$\""
    | stats count min(_time) as firstTime max(_time) as lastTime by user, message, host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `splunk_rce_through_arbitrary_file_write_to_windows_system_root_filter`
how_to_implement: This search requires access to the _internal index and only applies Splunk Enterprise installations on Microsoft Windows. Apps, messages, and/or users reported by the search should be analyzed to see if they are legitimate.
known_false_positives: This search may produce false positives as it is not possible to analyze the contents of an App Creation. This only applies to Splunk installations on Microsoft Windows where installation is placed on a different root directory like e or d.
references:
    - https://advisory.splunk.com/advisories/SVD-2024-1001
    - https://advisory.splunk.com/advisories/SVD-2024-1003
analytic_story:
    - Splunk Vulnerabilities
asset_type: Splunk Server
cve:
    - CVE-2024-45731
    - CVE-2024-45733
mitre_attack_id:
    - T1210
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '5408.5525'
title: Suspicious Spool Authentication
description: 'It is possible to trigger RPC call using SpoolService bug, commonly
  found in NTLM relay attacks. - Software Association: Ransom Cartel, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR
  "<EventID>4624<") Authentication_Package=NTLM) OR ((TERM(EventCode=5145) OR "<EventID>5145<")
  AND TERM(spoolss))| table _time, host, user signature_id, Account_Name, user, Relative_Target_Name,
  signature_id, src_ip | bin span=5s | stats values(*) as * by _time, host, user |
  where (match(signature_id, "(?i)4624") AND match(signature_id, "(?i)5145")) | eventstats
  dc(src_ip) as dc_src_ip by host| where dc_src_ip>=1 '
techniques:
- credential-access:adversary-in-the-middle:llmnr/nbt-ns poisoning and smb relay
technique_id:
- T1557.001
data_category:
- Windows event logs
references:
- https://dirkjanm.io/a-different-way-of-abusing-zerologon/
- https://github.com/cube0x0/CVE-2021-1675
- https://securityaffairs.co/wordpress/119839/hacking/printnightmare-patch-bypass.html

name: Time Provider Persistence Registry
id: 5ba382c4-2105-11ec-8d8f-acde48001122
version: 16
creation_date: '2021-09-29'
modification_date: '2026-07-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: |-
    The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path.
    This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host.
    If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Registry WHERE

    Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\*"
    Registry.registry_value_name = "DllName"
    NOT Registry.registry_value_data IN
    (
        "%SystemRoot%\\System32\\vmictimeprovider.dll",
        "%SystemRoot%\\System32\\w32time.dll",
        "C:\\Windows\\System32\\vmictimeprovider.dll",
        "C:\\Windows\\System32\\w32time.dll"
    )

    by Registry.action Registry.dest Registry.process_guid Registry.process_id
       Registry.registry_hive Registry.registry_path Registry.registry_key_name
       Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type
       Registry.status Registry.user Registry.vendor_product

    | `drop_dm_object_name(Registry)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `time_provider_persistence_registry_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: No false positives have been identified at this time.
references:
    - https://pentestlab.blog/2019/10/22/persistence-time-providers/
    - https://attack.mitre.org/techniques/T1547/003/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Hermetic Wiper
    - Windows Privilege Escalation
    - Windows Persistence Techniques
    - Windows Registry Abuse
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1547.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Application Layer Protocol RMS Radmin Tool Namedpipe
id: b62a6040-49f4-47c8-b3f6-fc1adb952a33
version: 9
creation_date: '2022-06-24'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the use of default or publicly known named pipes associated with the RMX remote admin tool. It leverages Sysmon EventCodes 17 and 18 to identify named pipe creation and connection events. This activity is significant as the RMX tool has been abused by adversaries and malware like Azorult to collect data from targeted hosts. If confirmed malicious, this could indicate unauthorized remote administration capabilities, leading to data exfiltration or further compromise of the affected system. Immediate investigation is required to determine the legitimacy of this tool's presence.
data_source:
    - Sysmon EventID 17
    - Sysmon EventID 18
search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") | stats  min(_time) as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: False positives may be present. Filter based on pipe name or process.
references:
    - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
    - https://attack.mitre.org/techniques/T1071/
finding:
    title: possible RMS admin tool named pipe was created in endpoint $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Azorult
asset_type: Endpoint
mitre_attack_id:
    - T1071
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Create Local Administrator Account Via Net
id: 2c568c34-bb57-4b43-9d75-19c605b98e70
version: 11
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_net`
        AND
        Processes.process=*/add*
        AND
        Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_create_local_administrator_account_via_net_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators often leverage net.exe to create admin accounts.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - DHS Report TA18-074A
    - CISA AA22-257A
    - Medusa Ransomware
    - CISA AA24-241A
    - Azorult
    - DarkGate Malware
    - GhostRedirector IIS Module and Rungan Backdoor
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1136.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Ldifde Directory Object Behavior
id: 35cd29ca-f08c-4489-8815-f715c45460d3
version: 12
creation_date: '2023-05-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the use of Ldifde.exe, a command-line utility for creating, modifying, or deleting LDAP directory objects. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution and command-line arguments. Monitoring Ldifde.exe is significant because it can be used by attackers to manipulate directory objects, potentially leading to unauthorized changes or data exfiltration. If confirmed malicious, this activity could allow an attacker to gain control over directory services, escalate privileges, or access sensitive information within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name=ldifde.exe Processes.process IN ("*-i *", "*-f *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_ldifde_directory_object_behavior_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present, filter as needed.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Ldifde/
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
    - https://twitter.com/0gtweet/status/1564968845726580736?s=20
    - https://strontic.github.io/xcyclopedia/library/ldifde.exe-45D28FB47E9B6ACC5DCA9FDA3E790210.html
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing ldifde on a domain controller.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing ldifde on a domain controller.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Volt Typhoon
asset_type: Endpoint
atomic_guid:
    - 22cf8cb9-adb1-4e8c-80ca-7c723dfc8784
mitre_attack_id:
    - T1105
    - T1069.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Mimikatz Binary Execution
id: a9e0d6d3-9676-4e26-994d-4e0406bb4467
version: 14
creation_date: '2022-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name=mimikatz.exe
            OR
            Processes.original_file_name=mimikatz.exe
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_mimikatz_binary_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as this is directly looking for Mimikatz, the credential dumping utility.
references:
    - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
    - https://www.varonis.com/blog/what-is-mimikatz
    - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting dump credentials.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting dump credentials.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Sandworm Tools
    - Volt Typhoon
    - Flax Typhoon
    - CISA AA22-320A
    - CISA AA23-347A
    - Compromised Windows Host
    - Credential Dumping
    - Scattered Spider
asset_type: Endpoint
mitre_attack_id:
    - T1003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Powershell Logoff User via Quser
id: 6d70780d-4cfe-4820-bafd-1b43941986b5
version: 9
creation_date: '2024-12-13'
modification_date: '2026-06-29'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the process of logging off a user through the use of the quser and logoff commands.
    By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt.
    This detection helps identify potential misuse or malicious activity where a user's access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText = "*quser*logoff*"
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id
         user_id vendor_product EventID
         Guid Opcode Name
         Path ProcessID ScriptBlockId
         ScriptBlockText
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_powershell_logoff_user_via_quser_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command.
references:
    - https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$ by user $user_id$
analytic_story:
    - Crypto Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1531
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Creation Using Registry Entry
id: 25212358-948e-11ec-ad47-acde48001122
version: 20
creation_date: '2022-02-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: Anomaly
description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Third party tools may used this technique to create services but not so common.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A Windows Service was created on a endpoint from $dest$ using a registry entry
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - PlugX
    - CISA AA23-347A
    - China-Nexus Threat Activity
    - Windows Persistence Techniques
    - SnappyBee
    - Derusbi
    - Windows Registry Abuse
    - Salt Typhoon
    - Active Directory Lateral Movement
    - Suspicious Windows Registry Activities
    - Crypto Stealer
    - Brute Ratel C4
    - Gh0st RAT
asset_type: Endpoint
mitre_attack_id:
    - T1574.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5703.5976'
title: Windows Service Started
description: 'Adversaries may abuse the Windows service control manager to execute
  malicious commands or payloads. - Threat Actor Association: APT28 (aka.Fancy Bear,
  Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, Blackbyte, Carbanak, Earth Estries, Magic Hound (aka APT35, Charming Kitten,
  Phosphorus, and Mint Sandstorm) - Software Association: Ryuk, Snatch, WannaCry -
  Atomics T1569.002 Test#1 Atomics T1543.003 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(sc)
  OR TERM(sc.exe) OR TERM(net) OR TERM(net.exe) OR TERM(net1.exe)) AND TERM(start)
  |regex process="(?i)(sc|net|net1)(\.exe)?\s+start\s"| table _time, host, user, signature_id,
  process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:system services:service execution
technique_id:
- T1569.002
data_category:
- PowerShell logs
- Process command-line parameters
references: null