Splunk rules: 3f

name: Amazon EKS Kubernetes cluster scan detection
id: 294c4686-63dd-4fe6-93a2-ca807626704a
version: 7
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: experimental
type: Hunting
description: The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. It leverages AWS CloudWatch Logs data, focusing on user agents and authentication details. This activity is significant as it may indicate unauthorized scanning or probing of the Kubernetes cluster, which could be a precursor to an attack. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of services within the Kubernetes environment.
data_source: []
search: |-
    `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!="AWS Security Scanner"
      | rename sourceIPs{} as src_ip
      | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI)
        BY src_ip user.username user.groups{}
      | `security_content_ctime(lastTime)`
      | `security_content_ctime(firstTime)`
      | `amazon_eks_kubernetes_cluster_scan_detection_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch EKS Logs inputs.
known_false_positives: Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context.
references: []
analytic_story:
    - Kubernetes Scanning Activity
asset_type: Amazon EKS Kubernetes cluster
mitre_attack_id:
    - T1526
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '1043.1069'
title: Command and Control Detection
description: 'Detects malicious (like Github repositories or known suspicious IPs)
  sources based on a list of IPs and domains. - Threat Actor Association: APT29/Nobelium/Cozy
  Bear, Magic Hound (APT32, Phosphorus, Mint Sandstorm), UNC4990 - Software Association:
  Alchimist, Remcos RAT'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "<EventID>5156<") `fltr_bl_ip_address` | table _time, host, user dest_ip, dest_port,
  direction, dvc, dvc_nt_host, event_id, host, index, process_id, process_name, process_path,
  signature_id, source, sourcetype, src_ip, src_port, tag, transport, user | bin span=60s
  | stats values(*) as * by _time, host `hec_collect`'
techniques:
- command-and-control:application layer protocol:web protocols
- command-and-control:non-application layer protocol
technique_id:
- T1071.001
- T1095
data_category:
- Windows event logs
references: null

name: Detect AWS Console Login by User from New Region
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
version: 9
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Eric McGinnis Splunk
status: production
type: Hunting
description: The following analytic identifies AWS console login attempts by users from a new region. It leverages AWS CloudTrail events and compares current login regions against a baseline of previously seen regions for each user. This activity is significant as it may indicate unauthorized access attempts or compromised credentials. If confirmed malicious, an attacker could gain unauthorized access to AWS resources, potentially leading to data breaches, resource manipulation, or further lateral movement within the cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats earliest(_time) as firstTime latest(_time) as lastTime FROM datamodel=Authentication
      WHERE Authentication.signature=ConsoleLogin
      BY Authentication.user Authentication.src
    | iplocation Authentication.src
    | `drop_dm_object_name(Authentication)`
    | rename Region as justSeenRegion
    | table firstTime lastTime user justSeenRegion
    | join user type=outer [
    | inputlookup previously_seen_users_console_logins
    | rename Region as previouslySeenRegion
    | stats min(firstTime) AS earliestseen
      BY user previouslySeenRegion
    | fields earliestseen user previouslySeenRegion]
    | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region")
    | where userRegion= "New Region"
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime user previouslySeenRegion justSeenRegion userRegion
    | `detect_aws_console_login_by_user_from_new_region_filter`
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro.
known_false_positives: When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
references: []
analytic_story:
    - Suspicious AWS Login Activities
    - Suspicious Cloud Authentication Activities
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Instance
mitre_attack_id:
    - T1535
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
baselines:
    - Previously Seen Users in CloudTrail - Initial
    - Previously Seen Users In CloudTrail - Update

name: Linux Decode Base64 to Shell
id: 637b603e-1799-40fd-bf87-47ecbd551b66
version: 14
creation_date: '2022-06-17'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because  it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions.
data_source:
    - Sysmon for Linux EventID 1
    - Cisco Isovalent Process Exec
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    Processes.process="*|*"
    `linux_shells`
    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
       Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path Processes.process
       Processes.process_exec Processes.process_guid Processes.process_hash
       Processes.process_id Processes.process_integrity_level Processes.process_name
       Processes.process_path Processes.user Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | rex field=process "base64\s+(?<decode_flag>-{1,2}d\w*)"
    | where isnotnull(decode_flag)
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_decode_base64_to_shell_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present based on legitimate software being utilized. Filter as needed.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script
    - https://redcanary.com/blog/lateral-movement-with-secure-shell/
    - https://linux.die.net/man/1/base64
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ decoding base64 and passing it to a shell.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Linux Living Off The Land
    - Cisco Isovalent Suspicious Activity
asset_type: Endpoint
mitre_attack_id:
    - T1027
    - T1059.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Service Started Or Enabled
id: e0428212-61b7-11ec-88a3-acde48001122
version: 13
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation or enabling of services on Linux platforms using the systemctl or service tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name IN ("systemctl", "service")
            OR
            Processes.process IN ("*systemctl *", "*service *")
        )
        Processes.process IN ("* start *", "* enable *") AND NOT (Processes.os="Microsoft Windows" OR Processes.vendor_product="Microsoft Windows")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_service_started_or_enabled_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1543/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a commandline $process$ that may create or start a service on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Scheduled Tasks
    - Gomir
asset_type: Endpoint
mitre_attack_id:
    - T1053.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Setuid Using Setcap Utility
id: 9d96022e-6250-11ec-9a19-acde48001122
version: 11
creation_date: '2021-12-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process_name = setcap
            OR
            Processes.process = "*setcap *"
        )
        AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_setuid_using_setcap_utility_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A commandline $process$ that may set suid or sgid on $dest$
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1548.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: MacOS Gatekeeper Bypass
id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
    Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    (
        Processes.process = "*xattr*"
        Processes.process = "*com.apple.quarantine*"
    )
    OR
    (
        Processes.process = "*spctl*"
        Processes.process = "*master-disable*"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_gatekeeper_bypass_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrators or power users may need to disable Gatekeeper to install unsigned tools.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://ss64.com/mac/xattr.html
    - https://ss64.com/mac/spctl.html
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$
        - field: dest
          type: system
          score: 20
          message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Privilege Escalation
    - MacOS Post-Exploitation
    - MacOS Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1553.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 New MFA Method Registered
id: 4e12db1f-f7c7-486d-8152-a221cad6ac2b
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a user account within Office 365. It leverages O365 audit logs to identify changes in MFA configurations. This activity is significant as it may indicate an attacker's attempt to maintain persistence on a compromised account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges or access sensitive data. Immediate verification and remediation are required to secure the affected account.
data_source:
    - O365 Update user.
search: |
    `o365_management_activity`
    Workload=AzureActiveDirectory
    Operation="Update user."
    | eval propertyName = mvindex('ModifiedProperties{}.Name', 0)
    | search propertyName IN ("StrongAuthenticationMethod", "StrongAuthenticationPhoneAppDetail")
    | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0)
    | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0)
    | rex field=newvalue max_match=0 "(?i)(?<new_method_type>MethodType|DeviceName)"
    | rex field=oldvalue max_match=0 "(?i)(?<old_method_type>MethodType|DeviceName)"
    | eval count_new_method_type = coalesce(mvcount(new_method_type), 0)
    | eval count_old_method_type = coalesce(mvcount(old_method_type), 0)
    | where count_new_method_type > count_old_method_type
    | fillnull
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(propertyName) as propertyName
      by user newvalue oldvalue vendor_account
         vendor_product dest signature src
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_new_mfa_method_registered_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Users may register MFA methods legitimately, investigate and filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/005/
    - https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
    - https://www.csoonline.com/article/573451/sophisticated-bec-scammers-bypass-microsoft-365-multi-factor-authentication.html
finding:
    title: A new MFA method was added for $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Okta Unauthorized Access to Application
id: 5f661629-9750-4cb9-897c-1f05d6db8727
version: 10
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies attempts by users to access Okta applications that have not been assigned to them. It leverages Okta Identity Management logs, specifically focusing on failed access attempts to unassigned applications. This activity is significant for a SOC as it may indicate potential unauthorized access attempts, which could lead to exposure of sensitive information or disruption of services. If confirmed malicious, such activity could result in data breaches, non-compliance with data protection laws, and overall compromise of the IT environment.
data_source:
    - Okta
search: |-
    | tstats values(Authentication.app) as app values(Authentication.action) as action values(Authentication.user) as user values(Authentication.reason) as reason FROM datamodel=Authentication
      WHERE Authentication.signature=app.generic.unauth_app_access_attempt Authentication.action="failure"
      BY _time Authentication.src Authentication.user
         Authentication.dest
    | `drop_dm_object_name("Authentication")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | iplocation src
    | `okta_unauthorized_access_to_application_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: There is a possibility that a user may accidentally click on the wrong application, which could trigger this event. It is advisable to verify the location from which this activity originates.
references:
    - https://attack.mitre.org/techniques/T1110/003/
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: A user [$user$] is attempting to access an unauthorized application from IP Address - [$src$]
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1087.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: PingID New MFA Method After Credential Reset
id: 2fcbce12-cffa-4c84-b70c-192604d201d0
version: 9
creation_date: '2023-12-20'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
data_source:
    - PingID
search: "`pingid` \"result.message\" = \"*Device Paired*\" | rex field=result.message \"Device (Unp)?(P)?aired (?<device_extract>.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time = _time, user = upper(user) | fields user,src_user,EventID,PW_Change_Time] | eval timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,\"duration\"),\"(\\d*)\\+*(\\d+):(\\d+):(\\d+)\",\"\\2 hours \\3 minutes\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`"
how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription.
known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration.
references:
    - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677
    - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/
    - https://attack.mitre.org/techniques/T1098/005/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
finding:
    title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was $action$.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised User Account
    - Scattered Lapsus$ Hunters
asset_type: Identity
mitre_attack_id:
    - T1621
    - T1556.006
    - T1098.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

id: '17539.28699'
title: Potential network connection with CVE-2023-21554
description: Exploitation of CVE-2023-21554 (aka. QueueJumper), allow unauthorized
  attackers to remotely execute arbitrary code in the context of the Windows service
  process mqsvc.exe by reaching the TCP port 1801.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) OR "EventID>3<")
  "1801" "MQSVC" | table _time, host, user, signature_id, process, process_*, parent_process_*,
  src_ip, dest_ip | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:exploitation of remote services
technique_id: 
- T1210
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1048.003/T1048.003.md
- https://socfortress.medium.com/data-exfiltration-using-icmp-and-how-to-detect-it-69a799cca234

name: Screensaver Event Trigger Execution
id: 58cea3ec-1f6d-11ec-8560-acde48001122
version: 11
creation_date: '2021-09-28'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the SCRNSAVE.EXE registry entry, indicating potential event trigger execution via screensaver settings for persistence or privilege escalation. It leverages registry activity data from the Endpoint data model to identify changes to the specified registry path. This activity is significant as it is a known technique used by APT groups and malware to maintain persistence or escalate privileges. If confirmed malicious, this could allow an attacker to execute arbitrary code with elevated privileges, leading to further system compromise and persistent access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
known_false_positives: No false positives have been identified at this time.
references:
    - https://attack.mitre.org/techniques/T1546/002/
    - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver
finding:
    title: Registry path $registry_path$ was modified, added, or deleted on $dest$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Registry path $registry_path$ was modified, added, or deleted on $dest$.
analytic_story:
    - Hermetic Wiper
    - Windows Privilege Escalation
    - Windows Persistence Techniques
    - Windows Registry Abuse
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1546.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '16171.24333'
title: Suspicious Parent Process for lsass.exe or services.exe
description: This use case detects when either the Windows local security authority
  subsystem (lsass.exe) or service control manager (services.exe) are executed as
  a child from an unexpected parent process. This can indicate process injection/hollowing,
  masquerading, or other suspicious activity. The expected parent process for these
  services is wininit.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  ("services.exe" OR "lsass.exe") | regex process_path="(?i)\x5csystem32\x5c(lsass|services)\.exe"|
  regex parent_process_name!="(?i)wininit\.exe"| where isnotnull(parent_process_name)
  and not match(parent_process_name, "^-$") | table _time, host, user process, process_*,
  parent_process_name, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:process injection
technique_id:
- T1036.004
- T1055
data_category:
- Windows Sysmon
references:
- https://andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/

name: Windows AutoIt3 Execution
id: 0ecb40d9-492b-4a57-9f87-515dd742794c
version: 14
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects the execution of AutoIt3, a scripting
    language often used for automating Windows GUI tasks and general scripting.
    It identifies instances where AutoIt3 or its variants are executed by searching for process names
    or original file names matching 'autoit3.exe'.
    This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware.
    If confirmed malicious, this activity could lead to unauthorized code execution,
    system compromise, or further propagation of malware within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
      max(_time) as lastTime
    from datamodel=Endpoint.Processes where
    (
      Processes.process_name = "autoit*.exe"
      OR
      Processes.original_file_name = "autoit*.exe"
    )
    by Processes.action Processes.dest Processes.original_file_name
       Processes.parent_process Processes.parent_process_exec
       Processes.parent_process_guid Processes.parent_process_id
       Processes.parent_process_name Processes.parent_process_path
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id Processes.process_integrity_level
       Processes.process_name Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_autoit3_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed.
references:
    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
finding:
    title: Execution of AutoIt3 detected. The source process is $parent_process_name$ and the destination process is $process_name$ on $dest$ by
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Execution of AutoIt3 detected. The source process is $parent_process_name$ and the destination process is $process_name$ on $dest$ by
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Crypto Stealer
    - Handala Wiper
    - DarkGate Malware
    - Void Manticore
asset_type: Endpoint
mitre_attack_id:
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Boot or Logon Autostart Execution In Startup Folder
id: 99d157cb-923f-4a00-aee9-1f385412146f
version: 17
creation_date: '2023-01-16'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
data_source:
    - Sysmon EventID 11
search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: Administrators may allow creation of script or exe in this path.
references:
    - https://attack.mitre.org/techniques/T1204/002/
    - https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: a process dropped a file in %startup% folder on $dest$
        - field: dest
          type: system
          score: 20
          message: a process dropped a file in %startup% folder on $dest$
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - XWorm
    - Chaos Ransomware
    - NjRAT
    - Crypto Stealer
    - Gozi Malware
    - Quasar RAT
    - RedLine Stealer
    - Interlock Ransomware
    - APT37 Rustonotto and FadeStealer
    - PromptFlux
    - BlankGrabber Stealer
    - Phantom Stealer
    - Starland RAT Campaign
asset_type: Endpoint
mitre_attack_id:
    - T1547.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Chrome Auto-Update Disabled via Registry
id: 619eac6c-0f03-4699-ae29-5f337877bcf9
version: 4
creation_date: '2026-01-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates.
    Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates.
    This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence.
    Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry

    where Registry.registry_path = "*\\Google\\Update*"
          AND
          (
            Registry.registry_value_name = "DisableAutoUpdateChecksCheckboxValue"
            Registry.registry_value_data = 0x00000001
          )
          OR
          (
            Registry.registry_value_name  IN (
              "AutoUpdateCheckPeriodMinutes",
              "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}",
              "UpdateDefault"
            )
            Registry.registry_value_data = 0x00000000
          )

    by Registry.action Registry.dest Registry.process_guid Registry.process_id
       Registry.registry_hive Registry.registry_path Registry.registry_key_name
       Registry.registry_value_data Registry.registry_value_name
       Registry.registry_value_type Registry.status Registry.user Registry.vendor_product

    | `drop_dm_object_name(Registry)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_chrome_auto_update_disabled_via_registry_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting
    logs with the registry value name, registry path, and registry value data from your
    endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
    Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: |
    IT administrators intentionally disabling auto-updates in managed environments for testing, compatibility, or deployment purposes.
references:
    - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Chrome Auto-update in $registry_path$ was disabled on $dest$
analytic_story:
    - Browser Hijacking
asset_type: Endpoint
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Detect Network Scanner Behavior
id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7
version: 9
creation_date: '2024-12-26'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation.
data_source:
    - Sysmon EventID 3
search: '| tstats `security_content_summariesonly` count values(All_Traffic.action) as action values(All_Traffic.dest) as dest values(All_Traffic.dest_port) as dest_port values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dvc) as dvc values(All_Traffic.direction) as direction values(All_Traffic.protocol) as protocol values(All_Traffic.protocol_version) as protocol_version values(All_Traffic.src_port) as src_port values(All_Traffic.transport) as transport dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by All_Traffic.app All_Traffic.src All_Traffic.src_ip All_Traffic.user All_Traffic.vendor_product _time span=5m | `drop_dm_object_name(All_Traffic)` | rex field=app ".*\\\(?<process_name>.*)$" | where port_count > 10 OR dest_count > 10 | stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by user,app,process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_detect_network_scanner_behavior_filter`'
how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel.
known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed.
references:
    - https://attack.mitre.org/techniques/T1595
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$
        - field: user
          type: user
          score: 20
          message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Network Discovery
    - Windows Discovery Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1595.001
    - T1595.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: network

name: Windows Explorer LNK Exploit Process Launch With Padding
id: 8775fcf3-05e4-4525-bba2-a56e39d8d050
version: 5
creation_date: '2025-03-24'
modification_date: '2026-05-13'
author: Michael Haag, AJ King, Splunk, Jesse Hunter, Splunk Community Contributor
status: production
type: TTP
description: This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes with abnormally large padding (50 or more spaces) in the command line. This specific pattern is a key indicator of the ZDI-CAN-25373 Windows shortcut zero-day vulnerability exploitation, where threat actors craft malicious LNK files containing padded content to trigger code execution. The excessive spacing in the command line is used to manipulate the way Windows processes the shortcut file, enabling arbitrary code execution. This technique has been actively exploited by multiple APT groups in targeted attacks, with malicious LNK files being delivered through both HTTP and SMB protocols. The presence of significant command line padding when Explorer.exe launches command shells is highly suspicious and warrants immediate investigation.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" (Processes.process_path="*\\cmd.exe" OR Processes.process_path="*\\powershell.exe") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process=".*?\s{50,}.*" | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns. Reduce or increase the padding threshold based on observed false positives.
references:
    - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
finding:
    title: Windows Explorer.exe spawning PowerShell or cmd.exe with excessive padding (50+ spaces) on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Windows Explorer.exe spawning PowerShell or cmd.exe with excessive padding (50+ spaces) on $dest$ by $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows IOBit Unlocker Extension DLL Registration via Regsvr32
id: 2ba4b456-76e2-439d-bca6-fd5ef24cc53b
version: 2
creation_date: '2021-12-08'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects the IOBit Unlocker Extension being registered.
    IObit Unlocker is a utility designed to resolve issues involving files or folders that cannot be deleted, moved, or renamed due to being locked by other processes or applications in Windows.
    It's a powerful tool that can "unlock" these files or folders, terminating any processes that are using them.
    This allows users to manipulate these previously inaccessible files or folders as needed.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process="*IObitUnlockerExtension.dll*"
    Processes.process_name="regsvr32.exe"

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_iobit_unlocker_extension_dll_registration_via_regsvr32_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate users may run IObit Unlocker to manage locked files for maintenance or troubleshooting. Filter detections for approved use to reduce false alerts.
references:
    - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
finding:
    title: Potential IOBit Unlocker Extension DLL activity observed on $dest$ via $process$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1218.010
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Modify Registry Qakbot Binary Data Registry
id: 2e768497-04e0-4188-b800-70dd2be0e30d
version: 13
creation_date: '2022-10-24'
modification_date: '2026-05-13'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects the creation of a suspicious registry entry by Qakbot malware, characterized by 8 random registry value names with encrypted binary data. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry modifications under the "SOFTWARE\\Microsoft\\" path by processes like explorer.exe. This activity is significant as it indicates potential Qakbot infection, which uses the registry to store malicious code or configuration data. If confirmed malicious, this could allow attackers to maintain persistence and execute arbitrary code on the compromised system.
data_source:
    - Sysmon EventID 1 AND Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count dc(registry_value_name) as registry_value_name_count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*" AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | eval registry_key_name_len = len(registry_key_name) | eval registry_value_name_len = len(registry_value_name) | regex registry_value_name="^[0-9a-fA-F]{8}" | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join process_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` ] | stats min(_time) as firstTime max(_time) as lastTime values(registry_value_name) as registry_value_name dc(registry_value_name) as registry_value_name_count values(registry_key_name) by dest process_guid process_name parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Registry with binary data created by $process_name$ on $dest$
analytic_story:
    - Qakbot
asset_type: Endpoint
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint