Splunk rules: 3e

name: Add or Set Windows Defender Exclusion
id: 773b66fe-4dd9-11ec-8289-acde48001122
version: 18
creation_date: '2021-11-25'
modification_date: '2026-06-08'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    The following analytic detects the use of commands to add or set exclusions
    in Windows Defender. It leverages data from Endpoint Detection and Response (EDR)
    agents, focusing on command-line executions involving "Add-MpPreference" or "Set-MpPreference"
    with exclusion parameters. This activity is significant because adversaries often
    use it to bypass Windows Defender, allowing malicious code to execute undetected.
    If confirmed malicious, this behavior could enable attackers to evade antivirus
    detection, maintain persistence, and execute further malicious activities without
    interference from Windows Defender.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
    as lastTime from datamodel=Endpoint.Processes where
    (
      Processes.process = "*Add-MpPreference *"
      OR
      Processes.process = "*Set-MpPreference *"
    )
    Processes.process IN (
          "*-Exclusion*",
          "*-ControlledFolderAccessAllowedApplications*",
          "*-AttackSurfaceReductionOnlyExclusions*"
          )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
       Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `add_or_set_windows_defender_exclusion_filter`
how_to_implement: |
    The detection is based on data that originates from Endpoint Detection
    and Response (EDR) agents. These agents are designed to provide security-related
    telemetry from the endpoints where the agent is installed. To implement this search,
    you must ingest logs that contain the process GUID, process name, and parent process.
    Additionally, you must ingest complete command-line executions. These logs must
    be processed using the appropriate Splunk Technology Add-ons that are specific to
    the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
    data model. Use the Splunk Common Information Model (CIM) to normalize the field
    names and speed up the data modeling process.
known_false_positives: |
    Admin or user may choose to use this windows features. Filter as needed.
references:
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
    - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2025-ps
finding:
    title: exclusion command $process$ executed on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: exclusion command $process$ executed on $dest$
analytic_story:
    - Compromised Windows Host
    - AgentTesla
    - Data Destruction
    - Remcos
    - CISA AA22-320A
    - ValleyRAT
    - XWorm
    - WhisperGate
    - Windows Defense Evasion Tactics
    - Crypto Stealer
    - NetSupport RMM Tool Abuse
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Azure AD Global Administrator Role Assigned
id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
version: 15
creation_date: '2022-08-17'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="*Global Administrator*"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           initiatedBy signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_global_administrator_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
references:
    - https://o365blog.com/post/admin/
    - https://adsecurity.org/?p=4277
    - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
    - https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
    - https://attack.mitre.org/techniques/T1098/003/
finding:
    title: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
    entity:
        field: initiatedBy
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
analytic_story:
    - Azure Active Directory Persistence
    - Azure Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco AI Defense Security Alerts by Application Name
id: 105e4a69-ec55-49fc-be1f-902467435ea8
version: 7
creation_date: '2025-02-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
data_source:
    - Cisco AI Defense Alerts
search: |-
    `cisco_ai_defense`
      | rename genai_application.application_name as application_name
      | rename connection.connection_name as connection_name
      ```Aggregating data by model name, connection name, application name, application ID, and user ID```
      | stats count
          values(user_id) as user_id
          values(event_message_type) as event_message_type
          values(event_action) as event_action
          values(policy.policy_name) as policy_name
          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name
          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type
          by model.model_name connection_name application_name application_id
      ```Evaluating severity based on policy name and guardrail ruleset type```
      | eval severity=case(
          policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical",
          policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high",
          guardrail_ruleset_type IN ("Toxicity"), "medium",
          true(), "low"
      )
      ```Calculating risk score based on severity level```
      | eval risk_score=case(
          severity="critical", 100,
          severity="high", 75,
          severity="medium", 50,
          severity="low", 25
      )
      | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name
      | `cisco_ai_defense_security_alerts_by_application_name_filter`
how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype.
known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
references:
    - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4
    - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html
intermediate_findings:
    entities:
        - field: application_name
          type: other
          score: 20
          message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$]
analytic_story:
    - Critical Alerts
asset_type: Web Application
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

name: Cisco IOS XE VTY Access Class Tampering
id: a01ca274-16cb-476d-a814-d2ffe29d8905
version: 1
creation_date: '2026-05-19'
modification_date: '2026-05-20'
author: Nasreddine Bencherchali
status: production
type: Anomaly
description: |
    This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. The Salt Typhoon notes describe configure HTTP activity followed by line vty changes and removal/re-application of an access-class within 60 seconds.
data_source:
    - Cisco IOS Logs
search: |-
    `cisco_ios`
    facility IN ("HA_EM", "PARSER")
    mnemonic IN ("LOG", "CFGLOG_LOGGEDCMD")
    message_text IN (
        "*access-class*",
        "*configure http*",
        "*line vty*"
    )
    | rex field=message_text "^(?:[^:]+:\s+)?(?:catchall:\s+)?(?<eem_command>.+?)\s*$"
    | rex field=message_text "<enteredCommand><cli>(?<parser_command>.*?)</cli>"
    | rex field=message_text "<user>(?<parser_user>[^<]+)</user>"
    | rex field=message_text "<srcIP>(?<parser_src_ip>[^<]+)</srcIP>"
    | eval command=lower(trim(coalesce(parser_command, eem_command, "")))
    | eval event_type=case(
        like(command, "configure http%") OR like(command, "ip http secure-server%"), "http_config",
        like(command, "line vty%"), "line_vty",
        like(command, "no access-class%"), "remove_access_class",
        like(command, "access-class%"), "add_access_class",
        true(), null())
    | where isnotnull(event_type)
    | eval user=coalesce(parser_user, user, "unknown")
    | eval src_ip=coalesce(parser_src_ip, src_ip, "unknown")
    | eval dest=coalesce(host, dvc, dest, "unknown")
    | bin _time span=1m
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(event_type) as event_types
                  values(user) as user
                  values(src_ip) as src_ip
                  values(command) as commands
      by _time dest
    | where mvfind(event_types, "line_vty") >= 0
            AND
            mvfind(event_types, "remove_access_class") >= 0
            AND
            mvfind(event_types, "add_access_class") >= 0
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_ios_xe_vty_access_class_tampering_filter`
how_to_implement: |
    Use the Cisco Catalyst Add-on for Splunk (https://splunkbase.splunk.com/app/7538) to Ingest Cisco IOS-XE syslog with sourcetype "cisco:ios" and enable archive/config command logging.
known_false_positives: |
    VTY ACL changes occur during legitimate management access updates. Filter approved maintenance windows and known administrators.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a
    - https://blog.talosintelligence.com/salt-typhoon-analysis/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cisco IOS-XE VTY access-class settings were removed and reapplied on $dest$ by $user$.
threat_objects:
    - field: commands
      type: command
analytic_story:
    - Salt Typhoon
asset_type: Network
mitre_attack_id:
    - T1562
    - T1021
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network

id: '44644.87462'
title: Command Line Homoglyphs - Windows
description: Threat actors may use homoglyph attacks by substituting characters in
  process names or commands with visually similar Unicode symbols to impersonate legitimate
  commands, or messages (e.g., using Cyrillic “а” instead of Latin “a”). This tactic
  is often used to evade string-based detection and confuse analysts during investigation.
  This use case detects Windows processes containing Unicode characters from commonly
  abused homoglyph ranges, including Cyrillic extended, Greek extended, and full-width
  Latin letters and digits.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  | regex process="[Ѐ-ӿͰ-Ͽａ-ｚＡ-Ｚ０-９]" | table _time, host, user, process, process_name,
  parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:obfuscated files or information:command obfuscation
technique_id:
- T1027.010
data_category:
- Windows Sysmon
references:
- https://app.any.run/tasks/c044f84a-fd44-47ab-b53f-976debf96e63
- https://www.zdnet.com/article/magecart-group-uses-homoglyph-attacks-to-fool-you-into-visiting-malicious-websites/
- https://www.meshsecurity.io/blog/homoglyph-attacks-understanding-and-mitigating-the-threat
- https://www.bitdefender.com/en-us/blog/businessinsights/homograph-phishing-attacks-when-user-awareness-is-not-enough

id: '1035.1043'
title: Common Reconnaissance Commands
description: 'These are reconnaissance commands that are most commonly used by attackers
  in order to collect information after gaining a access to the machine. -- Threat
  Actor Association: AbcBot, Alloy Taurus/Gallium, Andariel, APT27/Emissary Panda,
  APT28 (aka.Fancy Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM),
  APT29/Nobelium/Cozy Bear, APT33, APT35/Phosphorus/Magic Hound, APT36, APT43, Carbanak,
  FamousSparrow, FIN6, FIN7, FIN8, FIN12, FIN13, Gorgon Group, Kimsuky, MuddyWater,
  OilRig, SaintBear (aka UAC-0056, UNC2589, TA471), TA428, TA2541, TRAVELING SPIDER,
  UAC-0056, Volt Typhoon (Bronze Silhouette, Vanguard Panda), Winter Vivern, Wizard
  Spider -- Software Association: AvosLocker, BadHatch, Bazarloader, BianLian, Black
  Basta, Blackcat/ALPHV, Clop, Conti, Cyclops Blink, Emotet, GhostShell, Hancitor,
  Havex, IcedID, Insekt, Lockbit, NanoCore, Nefilim, PowerShortShell, Prometheus /
  Spook, PYSA/Mespinoza, QakBot, Remcos, Ryuk, Snatch, Sodinokibi/REvil, Trickbot,
  Vice Society, XingLocker -- Atomics T1007 Test#1 Atomics T1007 Test#2 Atomics T1016
  Test#1 Atomics T1016 Test#2 Atomics T1016 Test#3 Atomics T1016 Test#4 Atomics T1016
  Test#7 Atomics T1018 Test#1 Atomics T1018 Test#2 Atomics T1018 Test#3 Atomics T1018
  Test#5 Atomics T1018 Test#6 Atomics T1018 Test#8 Atomics T1518.001 Test#1 Atomics
  T1571 Test#1 Atomics T1033 Test #1 Atomics T1087.001 Test #4 Atomics T1087.001 Test
  #5 Atomics T1087.001 Test #6 Atomics T1087.001 Test #7 Atomics T1087.001 Test #8
  Atomics T1087.001 Test #9 Atomics T1087.001 Test #10 Atomics T1201 Test #5 Atomics
  T1201 Test #6'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_powershell` EventCode=4104 ("whoami"
  OR "dir" OR "systeminfo" OR "HOSTNAME" OR "ipconfig" OR "route" OR "arp" OR "netstat"
  OR "netsh" OR "schtasks" OR "tasklist" OR "driverquery" OR "qprocess" OR "nslookup"
  OR "tracert" OR "query" OR "cmdkey" OR ("net" AND ("localgroup" OR "group" OR "config"
  OR "share" OR "use" OR "user"))) | rex field=process mode=sed max_match=0 "s/(?mi)^(Path.+)|^(ScriptBlock
  ID.+)|^(Creating Scriptblock.+)//g"| rex field=process mode=sed "s/([\n\r]+)|(\s\s+)//g"|
  table _time, host, user dvc, dvc_nt_host, event_id, eventtype, host, index, parameters,
  process, process_id, process_name, process_path, shell, signature_id, source, sourcetype,
  src_user, tag, user, user_id | bin span=60s | stats values(*) as * by _time, host
  | where match(process,"(?i)((whoami)|(dir)|(hostname)|(hostname)|(systeminfo)|(ipconfig)|(route)|(arp)|(cmdkey))($|\s)")
  OR match(process,"(?i)((netstat)|(netsh)|(schtasks)|(tasklist)|(driverquery)|(qprocess)|(nslookup))($|\s)")
  OR match(process,"(?i)((tracert)|(query)|(net\s+((localgroup)|(group)|(config)|(share)|(use)|(user)|(view))))($|\s)")
  `hec_collect`'
techniques:
- discovery:system owner/user discovery
- execution:command and scripting interpreter
- discovery:account discovery:local account
- discovery:process discovery
- discovery:system information discovery
- discovery:system service discovery
- execution:command and scripting interpreter:unix shell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1033
- T1059
- T1087.001
- T1057
- T1082
- T1007
- T1059.003
- T1059.004
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://capec.mitre.org/data/definitions/577.html
- https://www.programmersought.com/article/71384528057/

id: '22209.39130'
title: Domain Trust Discovery Commands - Windows
description: 'Adversaries may attempt to gather information on domain trust relationships
  that may be used to identify lateral movement opportunities in Windows multi-domain/forest
  environments. This use case detects executions of domain trust discovery commands
  used with nltest.exe. nltest.exe is not included in the detection to account for
  instances where nltest.exe has been renamed. -- Software Association: Play -- Atomics
  T1482 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") ("/domain_trusts" OR "/trusted_domains") | table _time, host,
  user, process, process_*, parent_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:domain trust discovery
technique_id: 
- T1482
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest

id: '45179.90468'
title: Exfiltration via curl.exe - Windows
description: Threat actors may abuse curl.exe on Windows systems to exfiltrate data
  or upload files to remote servers using command-line options like -d, -T, --form,
  or --upload-file. These flags are commonly used for HTTP POST requests, enabling
  attackers to transmit files or sensitive information during post-compromise activity.
  This use case detects process creation events where curl.exe is used with data or
  file upload arguments, potentially indicating data exfiltration, C2 communication,
  or malicious use of legitimate tools.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(curl) ("-d" OR "-T" OR "-F" OR " --form" OR "--upload-file " OR "--data " OR
  "--data-") | where match(process_path, "(?i)\x5ccurl\.exe") and (match(process,
  "\s-[dTF]\s") or match(process, "(?i)\s--(form|upload-file|data)\s|\s--data-"))
  | table _time, host, user, process, process_path, process_name, parent_process_name,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over alternative protocol
technique_id: 
- T1048
data_category:
- Windows Sysmon
references:
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_fileupload.yml
- https://x.com/d1r4c/status/1279042657508081664
- https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
- https://curl.se/docs/manpage.html

id: '29738.53781'
title: Impacket atexec.py Temp File Creation
description: Impacket's atexec.py is a tool designed for executing commands on a target
  system via the Windows Task Scheduler to run arbitrary commands with the privileges
  of the account under which the scheduler is running, often providing a method for
  remote command execution which can be used by attackers during post-exploitation
  activities. This use case detects the file creation events matching characteristics
  of those created by Impacket atexec.py.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<") ("\\Windows\\System32\\Tasks\\" "svchost.exe") OR ("\\Windows\\Temp\\"
  ".tmp" "cmd.exe") | regex file_name="^([a-zA-Z]){8}(\.tmp)?$" | table _time, host,
  user, file_name, file_path, process_name | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:scheduled task/job
- execution:command and scripting interpreter
- execution:scheduled task/job:scheduled task
- persistence:scheduled task/job:scheduled task
- privilege-escalation:scheduled task/job:scheduled task
- execution:command and scripting interpreter:windows command shell
- defense-evasion:obfuscated files or information
technique_id:
- T1053
- T1059
- T1053.005
- T1059.003
- T1027
data_category:
- File monitoring
- Windows event logs
references:
- https://u0041.co/blog/post/1
- https://github.com/fortra/impacket/blob/master/examples/atexec.py
- https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '1037.1051'
title: Invoke-Expression Command
description: 'Detects when PowerShell Invoke-Expression is executed. -- Threat Group
  Association: Actinium/Gamaredon/Primitive Bear, Andariel, APT29/Nobelium/Cozy Bear,
  APT31, FIN7, FIN8, Lazarus, TA505, TA551, Turla (akaSecret Blizzard, KRYPTON, and
  UAC-0003), WinterVivern/UAC-0114, Winter Vivern, WIRTE, Wizard Spider - Software
  Association: ALPHV/BlackCat, BadHatch, Bazar, Black Basta, Clop, Conti, Cring, IcedID,
  LV, Play, PowerShortShell, PurpleFox, PYSA/Mespinoza, Remcos, SamSam, SquirrelWaffle,
  Trickbot, XingLocker -- #TrendingThreat #Russia #Ukraine -- Atomics T1059.001 Test
  #1 Atomics T1059.001 Test #4 Atomics T1059.001 Test #5 Atomics T1059.001 Test #8
  Atomics T1059.001 Test #11 Atomics T1059.001 Test #13 Atomics T1135 Test #6 Atomics
  T1059.005 Test #2 Atomics T1059.005 Test #3 Atomics T1134.002 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 (TERM("invoke-expression")
  OR TERM("iex")) | table _time, host, user dest, direction, dvc, dvc_nt_host, event_id,
  eventtype, hashes, host, index, parent_process, parent_process_id, parent_process_name,
  parent_process_path, process, process_current_directory, process_id, process_name,
  process_path, signature_id, source, sourcetype, tag, user, user_id `group_events("host,
  process", 1)` '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- Windows Sysmon
references:
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.1
- https://www.fortinet.com/blog/threat-research/offense-and-defense-a-tale-of-two-sides-powershell
- https://www.cyber.gov.au/acsc/view-all-content/publications/securing-powershell-enterprise
- https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/?utm_campaign=Threat%20Report%20Newsletter&utm_medium=email&_hsmi=203254280&_hsenc=p2ANqtz-_lmhDqWF4dK1aEuVSrgJUOHdLMvJ7ORkr-vdksakqAPIxGFhGLMHMGAUiX4y9HTdUyzYWBQlJ

name: O365 Mailbox Read Access Granted to Application
id: 27ab61c5-f08a-438a-b4d3-325e666490b3
version: 10
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies instances where the Mail.Read Graph API permissions are granted to an application registration within an Office 365 tenant. It leverages O365 audit logs, specifically events related to changes in application permissions within the AzureActiveDirectory workload. This activity is significant because the Mail.Read permission allows applications to access and read all emails within a user's mailbox, which often contain sensitive or confidential information. If confirmed malicious, this could lead to data exfiltration, spear-phishing attacks, or further compromise based on the information gathered from the emails.
data_source:
    - O365 Update application.
search: "`o365_management_activity` Operation=\"Update application.\" | eval json_data=mvindex('ModifiedProperties{}.NewValue',0) | eval json_data=replace(json_data,\"^\\[\\s*\",\"\") | eval json_data=replace(json_data,\"\\s*\\]$\",\"\") | spath input=json_data path=RequiredAppPermissions{}.EntitlementId output=EntitlementIds | eval match_found=mvfind(EntitlementIds, \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\") | where isnotnull(match_found) | fillnull | stats count earliest(_time) as firstTime max(_time) as lastTime values(EntitlementIds) as EntitlementIds by signature, user, dest, vendor_account, vendor_product, object, src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_mailbox_read_access_granted_to_application_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: There are legitimate scenarios in wich an Application registrations requires Mailbox read access. Filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://attack.mitre.org/techniques/T1114/002/
    - https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
    - https://www.cisa.gov/sites/default/files/publications/Supply_Chain_Compromise_Detecting_APT_Activity_from_known_TTPs.pdf
    - https://learn.microsoft.com/en-us/graph/permissions-reference
    - https://graphpermissions.merill.net/permission/Mail.Read
finding:
    title: Application registration $object$ was grandes mailbox read access by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.003
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: O365 Multiple Mailboxes Accessed via API
id: 7cd853e9-d370-412f-965d-a2bcff2a2908
version: 11
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects when a high number of Office 365 Exchange mailboxes are accessed via API (Microsoft Graph API or Exchange Web Services) within a short timeframe. It leverages 'MailItemsAccessed' operations in Exchange, using AppId and regex to identify API interactions. This activity is significant as it may indicate unauthorized mass email access, potentially signaling data exfiltration or account compromise. If confirmed malicious, attackers could gain access to sensitive information, leading to data breaches and further exploitation of compromised accounts. The threshold is set to flag over five unique mailboxes accessed within 10 minutes, but should be tailored to your environment.
data_source:
    - O365 MailItemsAccessed
search: |-
    `o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
      | bucket span=10m _time
      | eval matchRegex=if(match(ClientInfoString,"^Client=WebServices;ExchangeWebServices"), 1, 0)
      | search (AppId="00000003-0000-0000-c000-000000000000" OR matchRegex=1)
      | fillnull
      | stats values(ClientIPAddress) as src dc(user) as unique_mailboxes values(user) as user
        BY _time ClientAppId ClientInfoString
           vendor_account vendor_product dest
           signature
      | where unique_mailboxes > 5
      | `o365_multiple_mailboxes_accessed_via_api_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Legitimate applications may access multiple mailboxes via an API. You can filter by the ClientAppId or the CLientIpAddress fields.
references:
    - https://attack.mitre.org/techniques/T1114/002/
    - https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in
    - https://learn.microsoft.com/en-us/graph/permissions-reference
    - https://attack.mitre.org/techniques/T1114/002/
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/ews-applications-and-the-exchange-architecture
finding:
    title: An Oauth application identified with id $ClientAppId$ accessed multiple mailboxes in a short period of time via an API.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '24625.45524'
title: Permissions Replaced by icacls - Windows
description: 'icacls is a command-line utility in Windows that allows for viewing
  and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat
  actors may abuse this tool to alter file permissions, potentially gaining unauthorized
  access or control over sensitive files and directories, as observed by DFIR report
  (see references). This use case detects icacls executions with switches to replace
  permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "icacls" ("/grant:" OR "/deny:" OR "/remove:" OR "/setintegritylevel:"
  OR "/inheritance:") | rex field=_raw "(?<=icacls\.exe\"\s)(?<file_path>[^\s]+)"|
  rex field=_raw "/(grant|deny|remove|setintegritylevel|inheritance):\S\s(?<permission_user>[^\:]+):F"|
  table _time, host, user, process, process_*, parent_process, parent_process_*, user,
  file_path, permission_user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:file and directory permissions modification
- defense-evasion:file and directory permissions modification:windows file and directory
  permissions modification
technique_id:
- T1222
- T1222.001
data_category:
- PowerShell logs
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

id: '19351.33713'
title: Potential Credential Dumping of LSASS
description: 'This use case looks for access requests to lsass by a user, which may
  indicate an attempt to dump credentials. -- Threat Actor Association: Alloy Taurus/Gallium'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
  "<EventID>4656<") ("0x1010" OR "0x40" OR "0x1400" OR "0x100000" OR "0x1410" OR "0x1438"
  OR "0x143a" OR "0x1418" OR "0x1f0fff" OR "0x1f1fff" OR "0x1f2fff" OR "0x1f3fff")
  ) OR ((TERM(EventCode=4663) OR "<EventID>4663<") ("%%4484" OR "%%4416") ) "lsass.exe"
  | regex user!=".*\$" | table _time, host, user process, process_*, signature_id,
  parent_* | bin span=5s | stats values(*) as * by _time, host | where match(signature_id,
  "4656") and match(signature_id, "4663") '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Windows event logs
references: null

id: '45003.90187'
title: PowerShell CreateDecryptor
description: Threat actors may abuse the CreateDecryptor() method within PowerShell
  scripts to dynamically decrypt embedded payloads, configuration files, or sensitive
  data at runtime. CreateDecryptor() is part of legitimate .NET cryptographic operations,
  but its presence in PowerShell ScriptBlock or CommandLine activity — especially
  outside normal application behavior — often signals malware unpacking, fileless
  attacks, or ransomware staging. This use case detects references to CreateDecryptor
  in PowerShell activity, potentially indicating obfuscated payload execution or preparation
  for in-memory attacks.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "EventID>4688<" OR Type=Process) (TERM(powershell) OR TERM(pwsh)) "CreateDecryptor"
  | regex process="(?i)CreateDecryptor" | table _time, host, user process, process_*,
  signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- defense-evasion:obfuscated files or information
technique_id:
- T1059.001
- T1027
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.cybereason.com/blog/threat-analysis-lummastealer-2.0
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.createdecryptor?view=net-9.0
- https://www.virustotal.com/gui/file/034694376c291c82789e7dc2c8771a4dff47c1c447f2ea7427edb968f480fa71

name: PowerShell Loading DotNET into Memory via Reflection
id: 85bc3f30-ca28-11eb-bd21-acde48001122
version: 19
creation_date: '2021-06-15'
modification_date: '2026-06-29'
author: Michael Haag, Teoderick Contreras Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike.
    It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed.
    This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses.
    If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104
    ScriptBlockText IN (
        "*.LoadFrom(*",
        "*.LoadModule(*",
        "*.LoadWithPartialName*",
        "*Reflection.Assembly.Load*",
        "*Reflection.Assembly]::('daoL'[-1..-4] -join '')*",
        "*Reflection.Assembly]::Load*",
        "*ReflectionOnlyLoad*",
        "*UnsafeLoadFrom*"
    )

    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by dest signature signature_id user_id
         vendor_product EventID Guid Opcode
         Name Path ProcessID
         ScriptBlockId ScriptBlockText

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `powershell_loading_dotnet_into_memory_via_reflection_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: False positives should be limited as day to day scripts do not use this method.
references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$ by user $user_id$
analytic_story:
    - Winter Vivern
    - AgentTesla
    - AsyncRAT
    - Hermetic Wiper
    - Malicious PowerShell
    - Data Destruction
    - 0bj3ctivity Stealer
    - Hellcat Ransomware
    - Axios Supply Chain Post Compromise
    - VIP Keylogger
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5473.17082'
title: Rubeus Commands
description: 'Rubeus is a C# toolset for raw Kerberos interaction and abuses. -- Threat
  Actor Association: Wizard Spider - Software Association: Conti, Diavol, Quakbot/Qbot
  -- Atomics T1558.003 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` TERM(exe) ("EventCode=1" OR
  "<EventID>1<") (TERM(harvest) OR TERM(ptt) OR TERM(s4u) OR TERM(asktgt) OR TERM(brute)
  OR TERM(createnetonly) OR TERM(changepw) OR TERM(hash) OR TERM(tgssub) OR TERM(asktgs)
  OR TERM(renew) OR TERM(describe) OR TERM(monitor) OR TERM(purge) OR TERM(klist)
  OR TERM(triage) OR TERM(dump) OR TERM(tgtdeleg) OR TERM(kerberoast) OR TERM(asreproast)
  OR TERM(currentluid)) |regex process="(?i)\.exe\"?\s+(((harvest|ptt|s4u|asktgt|brute|createnetonly|changepw|hash|tgssub|asktgs|renew|describe|monitor)(\s+)?\/\w+\:)|((purge|klist|triage|dump|tgtdeleg|kerberoast|asreproast|currentluid)((\s+)?\/\w+)?))"
  | table _time, host, user, signature_id, process, process_id, process_name, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:steal or forge kerberos tickets
- credential-access:steal or forge kerberos tickets:golden ticket
- credential-access:steal or forge kerberos tickets:silver ticket
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558
- T1558.003
- T1558.002
- T1558.001
data_category:
- Windows Sysmon
references:
- https://github.com/GhostPack/Rubeus

name: Spoolsv Spawning Rundll32
id: 15d905f6-da6b-11eb-ab82-acde48001122
version: 14
creation_date: '2021-07-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the spawning of `rundll32.exe` without command-line arguments by `spoolsv.exe`, which is unusual and potentially indicative of exploitation attempts like CVE-2021-34527 (PrintNightmare). This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where `spoolsv.exe` is the parent process. This activity is significant as `spoolsv.exe` typically does not spawn other processes, and such behavior could indicate an active exploitation attempt. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the compromised endpoint.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name=spoolsv.exe `process_rundll32`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `spoolsv_spawning_rundll32_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.
references:
    - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available
    - https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675
    - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
finding:
    title: $parent_process_name$ has spawned $process_name$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - PrintNightmare CVE-2021-34527
    - Compromised Windows Host
    - Black Basta Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1547.012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5857.6155'
title: Suspicious Registry Key Created
description: 'Adversaries may achieve persistence by adding a program or referencing
  it with a Registry run key or by utilizing content triggered by Image File Execution
  Options (IFEO) debugger keys. Run keys may exist under multiple hives and IFEOs
  can also enable an arbitrary monitor program to be launched when a specified program
  silently exits. Multiple APTs leverage these Hives in order to establish persistence
  or execute additional payloads that appear to blend in with normal traffic. -- Threat
  Group Association: APT29/Nobelium/Cozy Bear, APT31, Kimsuky, TA505, Wizard Spider
  -- Software Association: BABYSHARK, Bazar, DirtyMoe, GhostShell, TrickBot -- Atomics
  T1003 Test #2 Atomic T1574.012 Test#1 Atomic T1574.012 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4657) OR
  "<EventID>4657<") Operation_Type="New registry value created" (TERM(vbs) OR TERM(dll))|
  regex New_Value="\.(vbs|dll)" | table _time, host, user parent_*, process, process_*,
  signature_id, Object_*, Operation_*, New_* | bin span=60s | stats values(*) as *
  by _time, host, process_name | where event_count < 3 | fields - Object_*, Operation_*,
  New_* `hec_collect`'
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- persistence:event triggered execution:image file execution options injection
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
  folder
- privilege-escalation:event triggered execution:image file execution options injection
technique_id:
- T1547.001
- T1546.012
data_category:
- File monitoring
- Windows event logs
references:
- https://blog.talosintelligence.com/2021/09/tinyturla.html

name: System Processes Run From Unexpected Locations
id: a34aae96-ccf8-4aef-952c-3ea21444444d
version: 17
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: The following analytic identifies system processes running from unexpected locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths, names, and hashes. This activity is significant as it may indicate a malicious process attempting to masquerade as a legitimate system process. If confirmed malicious, this behavior could allow an attacker to execute code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime max(_time) as lastTime
      FROM datamodel=Endpoint.Processes where
      NOT Processes.process_path IN (
        "*:\\$WINDOWS.~BT\\*",
        "*:\\$WinREAgent\\*",
        "*:\\Program Files \(x86\)\\Windows Kits\\10\\App Certification Kit\\*",
        "*:\\Windows\\SoftwareDistribution\\*",
        "*:\\Windows\\System32\\*",
        "*:\\Windows\\SystemTemp\\*",
        "*:\\Windows\\SysWOW64\\*",
        "*:\\Windows\\uus\\*",
        "*:\\Windows\\WinSxS\\*"
      )
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name("Processes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile
    | search systemFile=true
    | `system_processes_run_from_unexpected_locations_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
    - https://attack.mitre.org/techniques/T1036/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A System process $process_name$ is running from $process_path$ on $dest$, potentially non-standard.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Suspicious Command-Line Executions
    - Unusual Processes
    - Ransomware
    - Masquerading - Rename System Utilities
    - Qakbot
    - Windows Error Reporting Service Elevation of Privilege Vulnerability
    - DarkGate Malware
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint