Splunk rules: 3b

name: Batch File Write to System32
id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
version: 15
creation_date: '2020-04-29'
modification_date: '2026-07-02'
author: Steven Dick, Michael Haag, Rico Valdez, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior.
    This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation.
    If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Endpoint.Filesystem where

    Filesystem.action IN (
        "created",
        "modified"
    )
    Filesystem.file_path IN (
        "*:\\Windows\\System32\\*",
        "*:\\Windows\\SysWOW64\\*"
    )
    Filesystem.file_name IN (
        "*.bat",
        "*.cmd"
    )

    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash
       Filesystem.file_modify_time Filesystem.file_name
       Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid
       Filesystem.process_id Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `batch_file_write_to_system32_filter`
how_to_implement: |-
    To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
    You must also be ingesting the Endpoint.Filesystem data source.
known_false_positives: |-
    Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A new batch file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - SamSam Ransomware
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '38494.69242'
title: Certificate Abuse - Windows
description: Threat actors may use tools such as Certipy or Certify.exe to enumerate
  misconfigurations in certificate services, allowing them to gather information on
  potential vulnerabilities that could be exploited for privilege escalation or lateral
  movement within a network. This use case identifies potential abuse of Active Directory
  Certificate Services by monitoring Certificate Services events (4886 and 4887) or
  process creation events (event ID 4688) involving tools commonly used to exploit
  vulnerable configurations in AD CS such as certify.exe, accounting for instances
  where the binary has been renamed.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("certify.exe" OR "request " OR "/ca:" OR "/template:" OR "/altname:") | where match(process,
  "(?i)request\s.+/ca:.+/(template|altname):") | table _time, host, user user, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge authentication certificates
technique_id: 
- T1649
data_category:
- Windows Sysmon
references:
- https://github.com/ly4k/Certipy
- https://www.kali.org/tools/certipy-ad/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

id: '6158.6686'
title: Certutil Obfuscate_Encode Files
description: 'Certutil can be used to encode files to evade defensive measures. --
  Threat Actor Association: APT29/Nobelium/Cozy Bear, Arid Viper/APT C-23, BlackTech
  - Software Association: Conti'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") "certutil" TERM(encode)
  | table _time, host, user, signature_id, process | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:data encoding
- defense-evasion:obfuscated files or information
technique_id: 
- T1027
- T1132
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/

name: Circle CI Disable Security Step
id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
version: 9
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: experimental
type: Anomaly
description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes.
data_source:
    - CircleCI
search: |-
    `circleci`
      | rename workflows.job_id AS job_id
      | join job_id [
      | search `circleci`
      | stats values(name) as step_names count
        BY job_id job_name ]
      | stats count
        BY step_names job_id job_name
           vcs.committer_name vcs.subject vcs.url
           owners{}
      | rename vcs.* as * , owners{} as user
      | lookup mandatory_step_for_job job_name OUTPUTNEW step_name AS mandatory_step
      | search mandatory_step=*
      | eval mandatory_step_executed=if(like(step_names, "%".mandatory_step."%"), 1, 0)
      | where mandatory_step_executed=0
      | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
      | eval phase="build"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `circle_ci_disable_security_step_filter`
how_to_implement: You must index CircleCI logs.
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Disable security step $mandatory_step$ in job $job_name$ from user $user$
analytic_story:
    - Dev Sec Ops
asset_type: CircleCI
mitre_attack_id:
    - T1554
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Detect mshta renamed
id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
version: 13
creation_date: '2021-01-15'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name!=mshta.exe
        AND
        Processes.original_file_name=MSHTA.EXE
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_mshta_renamed_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.
references:
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
analytic_story:
    - Suspicious MSHTA Activity
    - Living Off The Land
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27059.49379'
title: DLL Called with Uncommon Function
description: DLLs can invoke a variety of functions when executed. While these functions
  are part of legitimate Windows operations, their execution from a DLL file, especially
  in an unusual context, can be indicative of malicious behavior. Threat actors including
  Qbot have been observed abusing this technique when calling DLLs with rundll32.exe.
  This use case detects calls of uncommon functions from DLL files, accounting for
  instances where rundll32.exe has been renamed. While these function calls may be
  legitimate, unexpected executions should be investigated. Living Off the Land Binary
  and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ".dll" ("RS32" OR "VirtualAllocEx" OR "NtUnmapViewOfSection"
  OR "CreateRemoteThread" OR "RtlCreateUserThread" OR "DeviceIoControl" OR "WriteProcessMemory"
  OR "CryptEncrypt" OR "CryptDecrypt" OR "RegSetValueEx" OR "SetWindowsHookEx" OR
  "DLLRegisterServer") | rex field=process "\.dll,(?<called_function>[^\s]+)"| where
  match(process, "(?i)\.dll\,(RS32|VirtualAllocEx|NtUnmapViewOfSection|CreateRemoteThread|RtlCreateUserThread|DeviceIoControl|WriteProcessMemory|CryptEncrypt|CryptDecrypt|RegSetValueEx|SetWindowsHookEx|DLLRegisterServer)")
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  called_function | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://redcanary.com/blog/lolbins-abuse/

name: ESXi Lockdown Mode Disabled
id: 07c0d28a-9a9b-409f-8d4b-65355bd19ead
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: This detection identifies when Lockdown Mode is disabled on an ESXi host, which can indicate that a threat actor is attempting to weaken host security controls. Disabling Lockdown Mode allows broader remote access via SSH or the host client and may precede further malicious actions such as data exfiltration, lateral movement, or VM tampering.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message IN ("*lockdownmode.disabled*", "*Administrator access to the host has been enabled*") | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_lockdown_mode_disabled_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Limited false positives in most environments, however tune as needed.
finding:
    title: Lockdown Mode has been disabled on ESXi host $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
asset_type: Infrastructure
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Large Volume of DNS ANY Queries
id: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies a large volume of DNS ANY queries, which may indicate a DNS amplification attack. It leverages the Network_Resolution data model to count DNS queries of type "ANY" directed to specific destinations. This activity is significant because DNS amplification attacks can overwhelm network resources, leading to Denial of Service (DoS) conditions. If confirmed malicious, this activity could disrupt services, degrade network performance, and potentially be part of a larger Distributed Denial of Service (DDoS) attack, impacting the availability of critical infrastructure.
data_source: []
search: |-
    | tstats `security_content_summariesonly` count FROM datamodel=Network_Resolution
      WHERE nodename=DNS "DNS.message_type"="QUERY" "DNS.record_type"="ANY"
      BY "DNS.dest"
    | `drop_dm_object_name("DNS")`
    | where count>200
    | `large_volume_of_dns_any_queries_filter`
how_to_implement: To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model.
known_false_positives: Legitimate ANY requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. You may modify the threshold in the search to better suit your environment.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Large Volume of DNS ANY Queries by $dest$
analytic_story:
    - DNS Amplification Attacks
asset_type: DNS Servers
mitre_attack_id:
    - T1498.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: MS Scripting Process Loading Ldap Module
id: 0b0c40dc-14a6-11ec-b267-acde48001122
version: 10
creation_date: '2021-09-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of MS scripting processes (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). It leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant as it may indicate an attempt to query LDAP for host information, a behavior observed in FIN7 implants. If confirmed malicious, this could allow attackers to gather detailed Active Directory information, potentially leading to further exploitation or data exfiltration.
data_source:
    - Sysmon EventID 7
search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: automation scripting language may used by network operator to do ldap query.
references:
    - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
    - https://attack.mitre.org/groups/G0046/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: $process_name$ loading ldap modules $ImageLoaded$ on $dest$
analytic_story:
    - FIN7
asset_type: Endpoint
mitre_attack_id:
    - T1059.007
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '28417.52060'
title: MultiDump.exe Execution
description: MultiDump is a post-exploitation tool written in C with a Python handler
  designed to discreetly dump and extract LSASS memory without triggering Defender
  alerts. This use case detects rundll32 executions with specific command line parameters
  unique to MultiDump.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "rundll32" "OpenOptimizationControlPanel" "cleanup" "defrag" "optimize:startup"
  "report" ".dmp" | table _time, host, user, process, process_*, parent_process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:security account manager
- credential-access:os credential dumping
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.002
- T1003
- T1003.001
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://xre0us.io/posts/multidump/
- https://github.com/Xre0uS/MultiDump?tab=readme-ov-file

name: O365 High Number Of Failed Authentications for User
id: 31641378-2fa9-42b1-948e-25e281cb98f7
version: 12
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies an O365 account experiencing more than 20 failed authentication attempts within 5 minutes. It uses O365 Unified Audit Logs, specifically "UserLoginFailed" events, to monitor and flag accounts exceeding this threshold. This activity is significant as it may indicate a brute force attack or password guessing attempt. If confirmed malicious, an attacker could gain unauthorized access to the O365 environment, potentially compromising sensitive emails, documents, and other data. Prompt investigation and action are crucial to prevent unauthorized access and data breaches.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon Workload=AzureActiveDirectory
      | bucket span=5m _time
      | fillnull
      | stats dc(_raw) AS failed_attempts values(src_ip) as src
        BY signature user _time
           dest vendor_account vendor_product
      | where failed_attempts > 10
      | `o365_high_number_of_failed_authentications_for_user_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Although unusual, users who have lost their passwords may trigger this detection. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1110/001/
finding:
    title: User $user$ failed to authenticate more than 10 times in the span of 5 minutes.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1110.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Ollama Excessive API Requests
id: 1cfab663-9adc-4169-a88c-6bae29ba3c70
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.
data_source:
    - Ollama Server
search: '`ollama_server` | rex field=_raw "\|\s+(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability.
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1498
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '33164.58809'
title: Suspicious ComputerDefaults.exe Execution
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects high or system
  integrity-level executions of ComputerDefaults.exe that are not initiated from Windows\System32
  or Program Files directories. Atomics T1548.002 Test #5 Living Off the Land Binary
  and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ComputerDefaults.exe" (IntegrityLevel="High" OR IntegrityLevel="System") | regex
  parent_process_path!="(?i):\x5c(Windows\x5cSystem32|Program\sFiles)"| regex process_path="(?i)\x5cComputerDefaults\.exe"
  | table _time, host, user ObjectName, process, process_*, parent_process_name |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml

name: Suspicious writes to windows Recycle Bin
id: b5541828-8ffd-4070-9d95-b3da4de924cb
version: 12
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rico Valdez, Splunk
status: production
type: TTP
description: The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.file_path = "*$Recycle.Bin*"
      BY Filesystem.process_name Filesystem.process_id Filesystem.dest
    | `drop_dm_object_name("Filesystem")`
    | join process_id dest [
    | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name != "explorer.exe"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | table user process_name process_id dest]
    | `suspicious_writes_to_windows_recycle_bin_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
known_false_positives: Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.
references: []
finding:
    title: Suspicious writes to windows Recycle Bin process $process_name$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Collection and Staging
    - PlugX
asset_type: Windows
mitre_attack_id:
    - T1036
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defenses Disable HVCI
id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79
version: 11
creation_date: '2023-04-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the disabling of Hypervisor-protected Code Integrity (HVCI) by monitoring changes in the Windows registry. It leverages data from the Endpoint datamodel, specifically focusing on registry paths and values related to HVCI settings. This activity is significant because HVCI helps protect the kernel and system processes from tampering by malicious code. If confirmed malicious, disabling HVCI could allow attackers to execute unsigned kernel-mode code, potentially leading to kernel-level rootkits or other severe security breaches.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed.
references:
    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
finding:
    title: HVCI has been disabled on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - BlackLotus Campaign
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
atomic_guid:
    - 70bd71e6-eba4-4e00-92f7-617911dbe020
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Process Injection into Notepad
id: b8340d0f-ba48-4391-bea7-9e793c5aae36
version: 13
creation_date: '2023-02-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
data_source:
    - Sysmon EventID 10
search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: False positives may be present based on SourceImage paths. If removing the paths is important, realize svchost and many native binaries inject into notepad consistently. Restrict or tune as needed.
references:
    - https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/
    - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$.
threat_objects:
    - field: SourceImage
      type: process
    - field: TargetImage
      type: process
analytic_story:
    - BishopFox Sliver Adversary Emulation Framework
    - Earth Alux
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1055.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint