Splunk rules: 3c

name: Azure AD Service Principal Owner Added
id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
version: 14
creation_date: '2022-08-30'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the addition of a new owner to a Service Principal within an Azure AD tenant. It leverages Azure Active Directory events from the AuditLog log category to identify this activity. This behavior is significant because Service Principals do not support multi-factor authentication or conditional access policies, making them a target for adversaries seeking persistence or privilege escalation. If confirmed malicious, this activity could allow attackers to maintain access to the Azure AD environment with single-factor authentication, potentially leading to unauthorized access and control over critical resources.
data_source:
    - Azure Active Directory Add owner to application
search: |-
    `azure_monitor_aad` operationName="Add owner to application"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename targetResources{}.userPrincipalName as newOwner
      | rename targetResources{}.modifiedProperties{}.newValue as displayName
      | eval displayName = mvindex(displayName,1)
      | where initiatedBy!=newOwner
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           result newOwner displayName
           signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_service_principal_owner_added_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/
finding:
    title: A new owner was added for service principal $displayName$ by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: displayName
          type: user
          score: 50
          message: A new owner was added for service principal $displayName$ by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
    - Azure Active Directory Privilege Escalation
    - NOBELIUM Group
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit

name: Disabling ControlPanel
id: 6ae0148e-9215-11eb-a94a-acde48001122
version: 17
creation_date: '2021-03-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects registry modifications that disable the Control Panel on Windows systems. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" with a value of "0x00000001". This activity is significant as it is commonly used by malware to prevent users from accessing the Control Panel, thereby hindering the removal of malicious artifacts and persistence mechanisms. If confirmed malicious, this could allow attackers to maintain control over the infected machine and prevent remediation efforts.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
    - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
finding:
    title: The Windows Control Panel was disabled on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: The Windows Control Panel was disabled on $dest$ by $user$.
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Get ADUserResultantPasswordPolicy with Powershell
id: 8b5ef342-065a-11ec-b0fc-acde48001122
version: 11
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of `powershell.exe` running the `Get-ADUserResultantPasswordPolicy` cmdlet, which is used to obtain the password policy in a Windows domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential enumeration of domain policies, a common tactic for situational awareness and Active Directory discovery by adversaries. If confirmed malicious, this could allow attackers to understand password policies, aiding in further attacks such as password spraying or brute force attempts.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name="cmd.exe"
            OR
            Processes.process_name="powershell*"
        )
        AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `get_aduserresultantpasswordpolicy_with_powershell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://attack.mitre.org/techniques/T1201/
    - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
finding:
    title: an instance of process $process_name$ with commandline $process$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: an instance of process $process_name$ with commandline $process$ on $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Get DomainUser with PowerShell Script Block
id: 61994268-04f4-11ec-865c-acde48001122
version: 13
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainUser` cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet is part of PowerView, a tool often used for domain enumeration. The detection leverages PowerShell operational logs to identify instances where this command is executed. Monitoring this activity is crucial as it may indicate an adversary's attempt to gather information about domain users, which is a common step in Active Directory Discovery. If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain resources.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_domainuser_with_powershell_script_block_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
finding:
    title: Powershell process having commandline "*Get-DomainUser*" for user enumeration on $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Powershell process having commandline "*Get-DomainUser*" for user enumeration on $dest$
analytic_story:
    - Active Directory Discovery
    - CISA AA23-347A
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux MySQL Privilege Escalation
id: c0d810f4-230c-44ea-b703-989da02ff145
version: 13
creation_date: '2022-08-10'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of MySQL commands with elevated privileges using sudo, which can lead to privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a potential misuse of MySQL to execute system commands as root, which could allow an attacker to gain root shell access. If confirmed malicious, this could result in full control over the affected system, leading to severe security breaches and unauthorized access to sensitive data.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process="*mysql*-e*"
        AND
        Processes.process="*\!**"
        AND
        Processes.process="*sudo*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_mysql_privilege_escalation_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
    - https://gtfobins.github.io/gtfobins/mysql/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Privilege Escalation
    - Linux Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: M365 Copilot Failed Authentication Patterns
id: 0ae94cdd-021a-4a62-a96d-9cec90b61530
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: production
type: Anomaly
description: Detects M365 Copilot users with failed authentication attempts, MFA failures, or multi-location access patterns indicating potential credential attacks or account compromise. The detection aggregates M365 Copilot Graph API authentication events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses and browsers, failed login attempts (status containing "fail" or "error"), and MFA failures (error code 50074). Users are flagged when they access Copilot from multiple cities (cities_count > 1), experience any authentication failures (failed_attempts > 0), or encounter MFA errors (mfa_failures > 0), which are indicators of credential stuffing, brute force attacks, or compromised accounts attempting to bypass multi-factor authentication.
data_source:
    - M365 Copilot Graph API
search: |-
    `m365_copilot_graph_api` (appDisplayName="*Copilot*" OR appDisplayName="M365ChatClient" OR appDisplayName="OfficeAIAppChatCopilot")
      | eval user = userPrincipalName
      | stats count as events, dc(location.city) as cities_count, values(location.city) as city_list, dc(location.countryOrRegion) as countries_count, values(location.countryOrRegion) as country_list, dc(ipAddress) as ip_count, values(ipAddress) as ip_addresses, sum(eval(if(match(status, "(?i)fail
      | error"), 1, 0))) as failed_attempts, sum(eval(if(match(_raw, "50074"), 1, 0))) as mfa_failures, dc(deviceDetail.browser) as browser_count, values(deviceDetail.browser) as browsers_used, min(_time) as first_seen, max(_time) as last_seen by user
      | eval first_seen = strftime(first_seen, "%Y-%m-%d %H:%M:%S")
      | eval last_seen = strftime(last_seen, "%Y-%m-%d %H:%M:%S")
      | where cities_count > 1 OR failed_attempts > 0 OR mfa_failures > 0
      | sort -mfa_failures, -failed_attempts, -countries_count
      | `m365_copilot_failed_authentication_patterns_filter`
how_to_implement: This detection requires ingesting M365 Copilot access logs via the Splunk Add-on for Microsoft Office 365. Configure the add-on to collect Azure AD Sign-in logs (AuditLogs.SignIns) through the Graph API data input. Ensure proper authentication and permissions are configured to access sign-in audit logs. The `m365_copilot_graph_api` macro should be defined to filter for sourcetype o365:graph:api data containing Copilot application activity.
known_false_positives: Legitimate users experiencing network connectivity issues, traveling employees with intermittent VPN connections, users in regions with unstable internet infrastructure, or password reset activities during business travel may trigger false positives.
references:
    - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: User $user$ exhibited suspicious M365 Copilot authentication patterns with $failed_attempts$ failed login attempts, $mfa_failures$ MFA failures, and access from $cities_count$ different locations, indicating potential credential compromise or brute force attack.
analytic_story:
    - Suspicious Microsoft 365 Copilot Activities
asset_type: Web Application
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: O365 Concurrent Sessions From Different Ips
id: 58e034de-1f87-4812-9dc3-a4f68c7db930
version: 14
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
data_source:
    - O365 UserLoggedIn
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoggedIn
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime values(src) as src
        BY signature dest user
           vendor_account vendor_product SessionId
      | where mvcount(src) > 1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_concurrent_sessions_from_different_ips_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1185/
    - https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
    - https://github.com/kgretzky/evilginx2
finding:
    title: User $user$ has logged in with the same session id from more than one unique IP address
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: O365 Tenant
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '28729.52252'
title: Process Executed from Downloads Folder - Windows
description: This use case detects the execution of executable files (.exe) that originate
  from the Downloads folder of any user profile on a system. This technique is commonly
  used by threat actors who leverage social engineering or phishing campaigns to trick
  users into downloading and executing malicious software, which can then be used
  for a variety of malicious purposes such as gaining unauthorized access, data exfiltration,
  or delivering additional payloads.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<")
  "C:\\Users\\*\\Downloads\\*" | regex process_path="(?i)C:\x5cUsers\x5c.+\x5cDownloads\x5c.+\.exe"
  | table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
  values(*) as * by _time, host, process_path '
techniques:
- execution:user execution
technique_id: 
- T1204
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/

name: Registry Keys for Creating SHIM Databases
id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel
status: production
type: TTP
description: The following analytic detects registry activity related to the creation of application compatibility shims. It leverages data from the Endpoint.Registry data model, specifically monitoring registry paths associated with AppCompatFlags. This activity is significant because attackers can use shims to bypass security controls, achieve persistence, or escalate privileges. If confirmed malicious, this could allow an attacker to maintain long-term access, execute arbitrary code, or manipulate application behavior, posing a severe risk to the integrity and security of the affected systems.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications
references: []
finding:
    title: A registry activity in $registry_path$ related to shim modication in host $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A registry activity in $registry_path$ related to shim modication in host $dest$
analytic_story:
    - Suspicious Windows Registry Activities
    - Windows Persistence Techniques
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1546.011
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '27238.49667'
title: rundll32.exe Executing DLL from Non-standard Directory
description: rundll32.exe is a legitimate Windows utility used to run functions stored
  in Dynamic Link Libraries. Because rundll32 is a trusted system utility with the
  ability to execute code, it is a high value target for abuse by threat actors. Threat
  actors leveraging Qbot malware have been observed dropping DLLs into writeable paths
  and calling them with rundll32.exe. This use case detects when a DLL in a nonstandard
  directory is called by rundll32. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "rundll32" ".dll" | regex process_name="(?i)rundll32\.exe"| regex process!="(?i)(rundll32(\.exe)?\"?\s+(\/\w+\s+)?[\w.]+\.dll)|(C:\x5c(Windows\x5c(System32|WinSxS|SysWoW64)|Program\sFiles(\s\(x86\))?\x5c.+\.dll))"|
  table _time, host, user, process_*, process, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:rundll32
technique_id:
- T1218.011
data_category:
- Windows Sysmon
references:
- https://redcanary.com/blog/lolbins-abuse/

id: '30808.55042'
title: Suspicious AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  installation of AteraAgent RMM with an IntegratorLogin from non-business email providers.
  In lieu of filtering for specific publicly available mail providers, a negative
  match for expected user email domains can be used.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "AteraAgent.exe" "/i " "IntegratorLogin=" ("@gmail.com" OR "@hotmail.com" OR "@outlook.com"
  OR "@yandex.ru" OR "@mail.ru" OR "@protonmail.com" OR "@dropmail.me") | rex field=process
  "IntegratorLogin=\"(?<integrator_email>[^\"]+)\""| where match(process_name, "(?i)AteraAgent\.exe")
  and match(process, "(?i)\/i\s.*IntegratorLogin=\S+@(gmail|hotmail|outlook|protonmail)\.com|(yandex|mail)\.ru|dropmail\.me")|
  table _time, host, user, process_*, integrator_email | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/
- https://detection.fyi/the-dfir-report/sigma-rules/windows/process_creation/proc_creation_win_ateraagent_malicious_installations/?query=ateraage

id: '17798.30045'
title: Suspicious Child Process for hh.exe
description: 'Adversaries may abuse Compiled HTML files (.chm) to conceal malicious
  code. CHM files are commonly distributed as part of the Microsoft HTML Help system.
  A custom CHM file containing embedded payloads could be delivered to a victim then
  triggered by User Execution. This use case detects hh.exe spawning suspicious child
  processes, including shell utilities and other native Windows utilities. -- Threat
  Actor Association: APT-K-47/Mysterious Elephant -- LOLBAS Atomics T1218.001 Test
  #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(hh) OR "hh.exe") (TERM(cmd) OR TERM(powershell) OR TERM(pwsh) OR TERM(wscript)
  OR TERM(cscript) OR TERM(regsvr32) OR TERM(wmic) OR TERM(rundll32) OR TERM(MSHTA)
  OR TERM(CertUtil) OR TERM(CertReq) OR TERM(MSbuild) OR TERM(installutil) OR TERM(schtasks)
  OR TERM(msiexec)) | where match(parent_process_name, "(?i)hh\.exe") and match(process_name,
  "(?i)cmd|powershell|pwsh|wscript|cscript|regsvr32|wmic|rundll32|MSHTA|CertUtil|CertReq|MSbuild|installutil|schtasks|msiexec")
  | table _time, host, user process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:compiled html file
technique_id:
- T1218.001
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md#atomic-test-2---compiled-html-help-remote-payload
- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/

id: '38368.69010'
title: Suspicious Confluence Child Process - Windows
description: 'Threat actors may target vulnerabilities in Confluence to gain initial
  access and then spawn command-line utilities from Confluence processes. This allows
  them to download malicious payloads or execute arbitrary commands on the compromised
  system, potentially leading to full system control or further lateral movement within
  the network. This use case detects when Confluence processes launch command-line
  utilities, potentially indicating that a threat actor has gained initial access
  through Confluence vulnerabilities such as CVE-2023-22527 or CVE-2023-22518. Note:
  logging of the full parent process file path is required for detection.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "Confluence" ("tomcat" OR "java.exe") ("pwsh.exe" OR "powershell.exe" OR "cmd.exe"
  OR "curl.exe" OR "wget.exe" OR "certutil.exe" OR "bitsadmin.exe" OR "mshta.exe"
  OR "regsvr32.exe") | regex parent_process_path="(?i)Confluence.*(tomcat\d+?|java)\.exe"|
  regex process_path="(?i)(pwsh|powershell|cmd|curl|wget|certutil|bitsadmin|mshta|regsvr32)\.exe"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- initial-access:exploit public-facing application
technique_id: 
- T1190
data_category:
- Windows Sysmon
references:
- https://github.com/ForceFledgling/CVE-2023-22518
- https://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html
- https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment

id: '8823.11629'
title: Suspicious Executable by CMD.exe
description: 'Detect when an executable has been launched by cmd.exe. Such as spawning
  powershell.exe, cscript rundll32 and similar processes being a child process of
  cmd. -- Threat Actor Association: APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard,
  Pawn Storm, TA422, STRONTIUM), APT34/OilRig, APT43, FIN8, Flax Typhoon, REvil, WinterVivern/UAC-0114
  - Software Association: Alchimist, AvosLocker, Black Basta, MagicRAT, Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "cmd.exe" ("powershell.exe" OR "services.exe" OR "dllhost.exe" OR "rundll32.exe"
  OR "cscript.exe" OR "regsvr32.exe") | regex parent_process_name="(?i)(cmd\.exe)"
  | regex process_path="(?i)((powershell)|(services)|(dllhost)|(rundll32)|(cscript)|(regsvr32))\.exe"
  | table _time, host, user event_id, parent_*, process_*, process, signature_id,
  src_*, dest_* | bin span=1s | stats values(*) as * by _time, host | where isnotnull(user) '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://secure.anvilogic.com/use_cases?id=AVL_UC1041#more_info

id: '17165.27787'
title: User_Domain Enumeration Tool - Windows
description: 'Adversaries may attempt to get a listing of domain accounts. This information
  can help adversaries determine which domain accounts exist to aid in follow-on behavior.
  This use case detects the execution of ADSISearcher or ADFind or parameters filtering
  for user or domain enumeration. -- Threat Actor Association: Alloy Taurus/Gallium
  -- Atomics T1087.002 Test #7 Atomics T1087.002 Test #12 Atomics T1087.002 Test #13
  Atomics T1087.002 Test #14 Atomics T1087.002 Test #16'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(adsisearcher) OR "adsisearcher") OR (TERM(adfind) OR "adfind") OR (TERM(kerbrute)
  OR "kerbrute") ("searchroot" OR "objectcategory=" OR "userenum") | regex process="(?i)searchroot|objectcategory=|userenum"
  | table _time, host, user, user, process | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- discovery:account discovery:domain account
- discovery:account discovery
- persistence:create account:domain account
technique_id:
- T1087.002
- T1136.002
data_category:
- Windows Sysmon
references:
- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/

name: Windows Impair Defense Change Win Defender Quick Scan Interval
id: 783f0798-f679-4c17-b3b3-187febf0b9b8
version: 11
creation_date: '2024-01-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry that change the Windows Defender Quick Scan Interval. It leverages data from the Endpoint.Registry data model, focusing on changes to the "QuickScanInterval" registry path. This activity is significant because altering the scan interval can impair Windows Defender's ability to detect malware promptly, potentially allowing threats to persist undetected. If confirmed malicious, this modification could enable attackers to bypass security measures, maintain persistence, and execute further malicious activities without being detected by quick scans.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Scan\\QuickScanInterval" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_quick_scan_interval_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender QuickScanInterval feature was modified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Indirect Command Execution Via Series Of Forfiles
id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be
version: 11
creation_date: '2022-12-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects excessive usage of the forfiles.exe process, which is often indicative of post-exploitation activities. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process GUID, process name, and parent process. This activity is significant because forfiles.exe can be abused to execute commands on multiple files, a technique used by ransomware like Prestige. If confirmed malicious, this behavior could allow attackers to enumerate files, potentially leading to data exfiltration or further malicious actions.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) as process_path values(Processes.user) as user  values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "forfiles.exe"
        OR
        Processes.original_file_name = "forfiles.exe"
      BY Processes.parent_process_name Processes.parent_process Processes.dest
         Processes.user _time span=1m
    | where count >=20
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_indirect_command_execution_via_series_of_forfiles_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
    - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: excessive forfiles process execution on $dest$
analytic_story:
    - Windows Post-Exploitation
    - Prestige Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1202
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry NoChangingWallPaper
id: a2276412-e254-4e9a-9082-4d92edb6a3e0
version: 12
creation_date: '2024-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the Windows registry aimed at preventing wallpaper changes. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "NoChangingWallPaper" registry value. This activity is significant as it is a known tactic used by Rhysida ransomware to enforce a malicious wallpaper, thereby limiting user control over system settings. If confirmed malicious, this registry change could indicate a ransomware infection, leading to further system compromise and user disruption.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\\NoChangingWallPaper" Registry.registry_value_data = 1) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_nochangingwallpaper_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
finding:
    title: the registry settings was modified to disable changing of wallpaper on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry to Add or Modify Firewall Rule
id: 43254751-e2ce-409a-b6b4-4f851e8dcc26
version: 12
creation_date: '2024-07-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a potential addition or modification of firewall rules, signaling possible configuration changes or security policy adjustments. It tracks commands such as netsh advfirewall firewall add rule and netsh advfirewall firewall set rule, which may indicate attempts to alter network access controls. Monitoring these actions ensures the integrity of firewall settings and helps prevent unauthorized network access.
data_source:
    - Sysmon EventID 13
    - Sysmon EventID 14
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"  Registry.action = modified by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
references:
    - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: firewall deletion found in registry on $dest$
        - field: dest
          type: system
          score: 20
          message: firewall deletion found in registry on $dest$
analytic_story:
    - ShrinkLocker
    - CISA AA24-241A
    - NetSupport RMM Tool Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows RDP Client Launched with Admin Session
id: 1af84ac8-05ea-4f11-8541-b2d1e45a7744
version: 6
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This detection identifies the execution of the Windows Remote Desktop Client (mstsc.exe) with the "/v" and /admin command-line arguments. The "/v" flag specifies the remote host to connect to, while the /admin flag initiates a connection to the target system’s console session, often used for administrative purposes. This combination may indicate that a user or attacker is performing privileged remote access, potentially to manage a system without disrupting existing user sessions. While such usage may be legitimate for IT administrators, it is less common in typical user behavior. Threat actors may abuse this capability during lateral movement to maintain stealthy access to high-value systems. Monitoring for this pattern can help detect interactive hands-on-keyboard activity, privilege abuse, or attempts to access critical infrastructure without leaving typical login traces associated with non-admin RDP sessions.
data_source:
    - Sysmon EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "mstsc.exe" Processes.process = "*/v:*" Processes.process = "*/admin*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rdp_client_launched_with_admin_session_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
references:
    - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
    - https://thelocalh0st.github.io/posts/rdp/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a rdp client launched with admin session on $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1021.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Remote Assistance Spawning Process
id: ced50492-8849-11ec-9f68-acde48001122
version: 13
creation_date: '2022-02-09'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects Microsoft Remote Assistance (msra.exe) spawning PowerShell.exe or cmd.exe as a child process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where msra.exe is the parent process. This activity is significant because msra.exe typically does not spawn command-line interfaces, indicating potential process injection or misuse. If confirmed malicious, an attacker could use this technique to execute arbitrary commands, escalate privileges, or maintain persistence on the compromised system.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=msra.exe `windows_shells`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_remote_assistance_spawning_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited, filter as needed. Add additional shells as needed.
references:
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://app.any.run/tasks/ca1616de-89a1-4afc-a3e4-09d428df2420/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Unusual Processes
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1055
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint