Splunk rules: 3i

name: ASL AWS New MFA Method Registered For User
id: 33ae0931-2a03-456b-b1d7-b016c5557fbd
version: 14
creation_date: '2023-01-31'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic identifies the registration of a new Multi-Factor Authentication (MFA) method for an AWS account, as logged through Amazon Security Lake (ASL). It detects this activity by monitoring the `CreateVirtualMFADevice` API operation within ASL logs. This behavior is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this activity could allow attackers to secure their access, making it harder to detect and remove their presence from the compromised environment.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=CreateVirtualMFADevice
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_new_mfa_method_registered_for_user_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
references:
    - https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
    - https://attack.mitre.org/techniques/T1556/
    - https://attack.mitre.org/techniques/T1556/006/
    - https://twitter.com/jhencinski/status/1618660062352007174
finding:
    title: A new virtual device is added to user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Secure Firewall - Binary File Type Download
id: 24b2c2e3-2ff7-4a23-b814-87f8a62028cd
version: 8
creation_date: '2025-04-09'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery.
    These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
    This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
    If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
data_source:
    - Cisco Secure Firewall Threat Defense File Event
search: |
    `cisco_secure_firewall` EventType=FileEvent FileDirection="Download"
    FileType IN ("ISHIELD_MSI", "BINHEX", "BINARY_DATA", "ELF", "MACHO", "JARPACK", "TORRENT", "AUTORUN", "EICAR", "LNK", "SCR", "UNIX_SCRIPT")
    | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(uri) as uri
            values(ClientApplication) as ClientApplication
            values(file_hash) as file_hash
            values(SHA_Disposition) as SHA_Disposition
            by FileDirection FileType src dest app file_name ThreatName dest_port Description
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table firstTime lastTime src dest dest_port FileDirection FileType Description uri file_name file_hash app ClientApplication SHA_Disposition ThreatName
    | `cisco_secure_firewall___binary_file_type_download_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the FileEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The malware & file access policy must also enable logging.
known_false_positives: IT admins or developers may legitimately download executables or scripts as part of their normal workflow. Apply additional filters accordingly.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ downloaded a file $file_name$ of type $FileType$ from $dest$.
threat_objects:
    - field: file_hash
      type: file_hash
    - field: file_name
      type: file_name
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1203
    - T1059
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: endpoint

id: '5381.5491'
title: Clear Command History
description: 'An adversary may clear the command history of a compromised account
  to conceal the actions undertaken during an intrusion. macOS and Linux both keep
  track of the commands users type in their terminal so that users can retrace what
  they''ve done. Atomics T1070.003 Test #1 Atomics T1070.003 Test #3 Atomics T1070.003
  Test #6 Atomics T1070.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve
  OR sourcetype=bash_history) AND ((TERM(unset) AND TERM(HISTFILE)) OR (TERM(export)
  AND (TERM(HISTSIZE) OR TERM(HISTFILESIZE) OR TERM(HISTFILE)) AND (TERM(0) OR "/dev/null"))
  OR (TERM(history) AND ((TERM(-c) OR TERM(-cw) OR TERM(-d)) OR (TERM(set) AND TERM(+o))
  OR (TERM(shopt) AND (TERM(-ou) OR (TERM(-o) AND TERM(-u)))))) OR (("HISTSIZE" OR
  "HISTFILESIZE") AND "0") OR ((TERM(rm) OR ((TERM(cat) OR TERM(ln)) AND "/dev/null"))
  OR ((TERM(echo) OR TERM(truncate)) AND TERM(bash_history)))) | rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")|
  eval process=mvappend(process, proc)| regex process="((unset\s+HISTFILE)|(export\s+HIST(FILE|SIZE|FILEZIE).+(0|\/dev\/null))|(history\s+\-(c|cw|d\s+\d+))|(set\s+\+o\s+history)|(shopt\s+(\-ou|\-o\s+\-u|\-u\s+\-o)\s+history)|((HISTSIZE|HISTFILESIZE)\=0)|((rm|cat\s+\/dev\/null\s+\>|cat\s+\>).+\Q.bash_history\E))|(((echo\s+\"\"\s+>)|(ln\s+.+?\s+/dev/null)|(truncate))\s+.+?\Q.bash_history\E)"
  | table _time, host, user process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- defense-evasion:indicator removal:clear command history
technique_id:
- T1070.003
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://www.countercraftsec.com/blog/post/new-threat-actor-alert-unc0628/

name: Control Loading from World Writable Directory
id: 10423ac4-10c9-11ec-8dc4-acde48001122
version: 13
creation_date: '2021-09-08'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies instances of control.exe loading a .cpl or .inf file from a writable directory, which is related to CVE-2021-40444. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as it may indicate an attempt to exploit a known vulnerability, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to gain control over the affected system, leading to further compromise.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
references:
    - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
    - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
    - https://attack.mitre.org/techniques/T1218/011/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Microsoft MSHTML Remote Code Execution CVE-2021-40444
    - Living Off The Land
    - Compromised Windows Host
asset_type: Endpoint
cve:
    - CVE-2021-40444
mitre_attack_id:
    - T1218.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '32841.58307'
title: Disabled Pre-Authentication Accounts Discovery - PowerShell
description: With the appropriate parameters, PowerShell cmdlets such as Get-ADUser
  or PowerView cmdlets including Get-DomainUser allow threat actors to discover domain
  accounts with Kerberos Pre-Authentication disabled, enabling them to target accounts
  vulnerable to Kerberos attacks such as AS-REP roasting. This use case detects PowerShell
  commands with parameters targeting accounts with Pre-Authentication disabled. PowerShell
  script block logging is recommended for best detection results. Detection using
  other log sources requires the PowerShell command to be run in a manner that creates
  a new process, such as powershell -command.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") ("Get-ADUser" ("4194304"
  OR "DoesNotRequirePreAuth")) OR ("Get-DomainUser" "PreauthNotRequired") OR "DONT_REQ_PREAUTH"
  | table _time, host, user process, process_*, signature_id, user _time | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- persistence:external remote services
- discovery:account discovery
technique_id: 
- T1133
- T1087
data_category:
- PowerShell logs
references:
- https://research.splunk.com/endpoint/114c6bfe-9406-11ec-bcce-acde48001122/
- https://attack.mitre.org/techniques/T1558/004/
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/

name: GitHub Organizations Disable 2FA Requirement
id: 3ed0d6ba-4791-4fa8-a1ef-403e438c7033
version: 9
creation_date: '2025-01-15'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Organizations. The detection monitors GitHub Organizations audit logs for 2FA requirement changes by tracking actor details, organization information, and associated metadata. For a SOC, identifying disabled 2FA requirements is critical as it could indicate attempts to weaken account security controls. Two-factor authentication is a fundamental security control that helps prevent unauthorized access even if passwords are compromised. Disabling 2FA requirements could allow attackers to more easily compromise accounts through password-based attacks. The impact of disabled 2FA includes increased risk of account takeover, potential access to sensitive code and intellectual property, and compromise of the software supply chain. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting broader account compromises.
data_source:
    - GitHub Organizations Audit Logs
search: |-
    `github_organizations` vendor_action=org.disable_two_factor_requirement
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor, actor_id, actor_ip,
           actor_is_bot, actor_location.country_code, business,
           business_id, org, org_id,
           user_agent, vendor_action
      | eval user=actor
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `github_organizations_disable_2fa_requirement_filter`
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
    - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ disabled 2FA requirement in GitHub Organizations
threat_objects:
    - field: user_agent
      type: http_user_agent
analytic_story:
    - GitHub Malicious Activity
asset_type: GitHub
mitre_attack_id:
    - T1685
    - T1195
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

name: Ivanti Connect Secure SSRF in SAML Component
id: 8e6ca490-7af3-4299-9a24-39fb69759925
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies POST requests targeting endpoints vulnerable to the SSRF issue (CVE-2024-21893) in Ivanti's products. It leverages the Web data model, focusing on endpoints such as /dana-ws/saml20.ws, /dana-ws/saml.ws, /dana-ws/samlecp.ws, and /dana-na/auth/saml-logout.cgi. The detection filters for POST requests that received an HTTP 200 OK response, indicating successful execution. This activity is significant as it may indicate an attempt to exploit SSRF vulnerabilities, potentially allowing attackers to access internal services or sensitive data. If confirmed malicious, this could lead to unauthorized access and data exfiltration.
data_source:
    - Suricata
search: |-
    | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.url IN ("*/dana-ws/saml20.ws*","*/dana-ws/saml.ws*","*/dana-ws/samlecp.ws*","*/dana-na/auth/saml-logout.cgi/*") Web.http_method=POST Web.status=200
      BY Web.src, Web.dest, Web.http_user_agent,
         Web.url, Web.status, Web.http_method
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ivanti_connect_secure_ssrf_in_saml_component_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: This analytic is limited to HTTP Status 200; adjust as necessary. False positives may occur if the HTTP Status is removed, as most failed attempts result in a 301. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
references:
    - https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis
    - https://www.assetnote.io/resources/research/ivantis-pulse-connect-secure-auth-bypass-round-two
finding:
    title: Possible exploitation of CVE-2024-21893 against $dest$ from $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Ivanti Connect Secure VPN Vulnerabilities
asset_type: VPN Appliance
cve:
    - CVE-2024-21893
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Auditd Service Restarted
id: 8eb3e858-18d3-44a4-a514-52cfa39f154a
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
data_source:
    - Linux Auditd Proctitle
search: |-
    `linux_auditd`  proctitle IN ("*systemctl *", "*service *") AND proctitle IN ("*restart*", "*reenable*", "*reload*")
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY proctitle dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_service_restarted_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1543/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A [$proctitle$] event occurred on host - [$dest$] to restart or re-enable a service.
analytic_story:
    - AwfulShred
    - Scheduled Tasks
    - Linux Privilege Escalation
    - Data Destruction
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Gomir
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1053.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '6127.6611'
title: NMAP Execution
description: 'Adversaries may attempt to get a listing of other systems by IP address,
  hostname, or other logical identifier on a network that may be used for Lateral
  Movement from the current system. This use case looks for executions of nmap that
  have been passed an IPv4 Address. -- Threat Actor Association: Alloy Taurus/Gallium'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(<EventID>4104<)) (TERM(nmap) OR "nmap.exe") | regex process="(?i)nmap(\.exe)?\"?\s+.+?(\d{1,3}\.){3}\d{1,3}"
  | table _time, host, user, signature_id, process, process_*, parent_process_* |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:remote system discovery
technique_id: 
- T1018
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

id: '15967.23884'
title: PowerShell Modifying Registry Values
description: 'Adversaries may interact with the Windows Registry to hide configuration
  information within Registry keys, remove information as part of cleaning up, or
  as part of other techniques to aid in persistence and execution. This use case detects
  PowerShell commands accessing or modifying the Current User or Local Machine registry
  hives. -- Threat Actor Association: CL-STA-0043 -- Atomics T1059.001 Test #11 Atomics
  T1546.008 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Invoke-Expression)
  OR "IEX") ("HKLM" OR "HKEY_LOCAL_MACHINE" OR "HKCU" OR "HKEY_CURRENT_USER") | table
  _time, host, user process, process_*, signature_id | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:modify registry
- execution:command and scripting interpreter:powershell
technique_id:
- T1112
- T1059.001
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution

id: '14971.22122'
title: Security Software Discovery via WMI
description: 'Adversaries may attempt to get a listing of security software, configurations,
  defensive tools, and sensors that are installed on a system or in a cloud environment.
  This may include things such as firewall rules and anti-virus. Adversaries may use
  the information from Security Software Discovery during automated discovery to shape
  follow-on behaviors, including whether or not the adversary fully infects the target
  and/or attempts specific actions. This use case detects enumeration commands for
  antivirus software using WMI. Atomics Test T1518.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(wmic) and TERM(AntiVirusProduct)) | regex
  process="(?i)\s+AntiVirusProduct\s+" | table _time, host, user, process, process_*,
  parent_process, parent_process_*, user | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- discovery:software discovery:security software discovery
technique_id:
- T1518.001
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518.001/T1518.001.md#atomic-test-6---security-software-discovery---av-discovery-via-wmi

id: '16041.40545'
title: Unusual svchost Child Process
description: 'Adversaries may inject code into processes in order to evade process-based
  defenses as well as possibly elevate privileges. Process injection is a method of
  executing arbitrary code in the address space of a separate live process. Running
  code in the context of another process may allow access to the process''s memory,
  system/network resources, and possibly elevated privileges. Execution via process
  injection may also evade detection from security products since the execution is
  masked under a legitimate process. Expected Service Host (svchost.exe) activity
  does not normally include certain child processes. Svchost spawning these child
  processes may be an indication of process injection. -- Threat Actor Association:
  Lazarus'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "svchost" ("WdiSystemHost" OR "LicenseManager" OR "StorSvc" OR "CDPSvc" OR "cdbhsvc"
  OR "BthAvctpSvc" OR "SstpSvc" OR "WdiServiceHost" OR "imgsvc" OR "TrkWks" OR "WpnService"
  OR "IKEEXT" OR "PolicyAgent" OR "CryptSvc" OR "netprofm" OR "ProfSvc" OR "StateRepository"
  OR "camsvc" OR "LanmanWorkstation" OR "NlaSvc" OR "EventLog" OR "hidserv" OR "DisplayEnhancementService"
  OR "ShellHWDetection" OR "AppHostSvc" OR "fhsvc" OR "CscService" OR "PushToInstall")
  | regex process="(?i)WdiSystemHost|LicenseManager|StorSvc|CDPSvc|cdbhsvc|BthAvctpSvc|SstpSvc|WdiServiceHost|imgsvc|TrkWks|WpnService|IKEEXT|PolicyAgent|CryptSvc|netprofm|ProfSvc|StateRepository|camsvc|LanmanWorkstation|NlaSvc|EventLog|hidserv|DisplayEnhancementService|ShellHWDetection|AppHostSvc|fhsvc|CscService|PushToInstall"|
  where match(parent_process_name, "(?i)svchost")| where not match(process_name, "(?i)werfault(secure)?|wermgr\.exe")
  | table _time, host, user process, process_*, parent_process_*, signature_id | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:process injection
technique_id: 
- T1055
data_category:
- Windows Sysmon
references:
- https://redcanary.com/threat-detection-report/techniques/process-injection/

id: '39293.71010'
title: Unusual winlogon.exe Child Process
description: Winlogon.exe is a core Windows process that manages secure user authentication
  events, such as logon, logoff, and screen locking. Expected child processes include
  LogonUI.exe for the login screen, FontDrvHost.exe for font rendering in secure sessions,
  Userinit.exe for initializing user settings, Consent.exe for User Account Control
  (UAC) prompts, and Sihost.exe for managing shell experience components like the
  Start menu and taskbar. This use case detects unexpected child processes spawned
  by winlogon.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(winlogon) OR "winlogon.exe" | regex parent_process_name="(?i)winlogon\.exe"|
  regex process_path!="(?i)\x5cWindows\x5cSystem32\x5c(AtBroker|LogonUI|dwm|fontdrvhost|userinit|consent|sihost)\.exe"
  | table _time, host, user, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:winlogon helper dll
- privilege-escalation:boot or logon autostart execution:winlogon helper dll
technique_id:
- T1547.004
data_category:
- Windows event logs
references:
- https://github.com/tykawaii98/CVE-2024-30088
- https://securityonline.info/poc-exploit-published-for-windows-kernel-elevation-of-privilege-vulnerability-cve-2024-30088/

name: Web Spring Cloud Function FunctionRouter
id: 89dddbad-369a-4f8a-ace2-2439218735bc
version: 9
creation_date: '2022-04-05'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies HTTP POST requests to the Spring Cloud Function endpoint containing "functionRouter" in the URL. It leverages the Web data model to detect these requests based on specific fields such as http_method, url, and http_user_agent. This activity is significant because it targets CVE-2022-22963, a known vulnerability in Spring Cloud Function, which has multiple proof-of-concept exploits available. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to unauthorized access, data exfiltration, or further compromise of the affected system.
data_source:
    - Splunk Stream HTTP
search: |-
    | tstats count FROM datamodel=Web
      WHERE Web.http_method IN ("POST") Web.url="*/functionRouter*"
      BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
         Web.src, Web.dest Web.status
         sourcetype
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `web_spring_cloud_function_functionrouter_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
known_false_positives: False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
references:
    - https://github.com/rapid7/metasploit-framework/pull/16395
    - https://github.com/hktalent/spring-spel-0day-poc
finding:
    title: A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Spring4Shell CVE-2022-22965
asset_type: Web Server
cve:
    - CVE-2022-22963
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Windows AD Short Lived Server Object
id: 193769d3-1e33-43a9-970e-ad4a88256cdb
version: 12
creation_date: '2022-10-18'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the creation and quick deletion of a Domain Controller (DC) object within 30 seconds in an Active Directory environment, indicative of a potential DCShadow attack. This detection leverages Windows Security Event Codes 5137 and 5141, analyzing the duration between these events. This activity is significant as DCShadow allows attackers with privileged access to register a rogue DC, enabling unauthorized changes to AD objects, including credentials. If confirmed malicious, this could lead to unauthorized AD modifications, compromising the integrity and security of the entire domain.
data_source:
    - Windows Event Log Security 5137
    - Windows Event Log Security 5141
search: |-
    `wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*"
      | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141)
      | eval short_lived=case((duration<30),"TRUE")
      | search short_lived = TRUE
      | stats values(ObjectDN) values(signature) values(EventCode)
        BY _time, Computer, SubjectUserName,
           dest
      | `windows_ad_short_lived_server_object_filter`
how_to_implement: To successfully implement this search, you ned to be ingesting Event codes `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required.
known_false_positives: Creating and deleting a server object within 30 seconds or less is unusual but not impossible in a production environment. Filter as needed.
references:
    - https://www.dcshadow.com/
    - https://attack.mitre.org/techniques/T1207/
    - https://stealthbits.com/blog/detecting-dcshadow-with-event-logs/
    - https://pentestlab.blog/2018/04/16/dcshadow/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141
finding:
    title: A short-lived server object was created and deleted on $Computer$
    entity:
        field: SubjectUserName
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: Computer
          type: system
          score: 50
          message: A short-lived server object was created and deleted on $Computer$
analytic_story:
    - Compromised Windows Host
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1207
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows InstallUtil in Non Standard Path
id: dcf74b22-7933-11ec-857c-acde48001122
version: 12
creation_date: '2022-01-20'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of InstallUtil.exe from non-standard paths. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names outside typical directories. This activity is significant because InstallUtil.exe is often used by attackers to execute malicious code or scripts. If confirmed malicious, this behavior could allow an attacker to bypass security controls, execute arbitrary code, and potentially gain unauthorized access or persist within the environment.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_in_non_standard_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
    - https://attack.mitre.org/techniques/T1036/003/
    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - Masquerading - Rename System Utilities
    - Ransomware
    - Unusual Processes
    - Signed Binary Proxy Execution InstallUtil
    - Living Off The Land
    - Data Destruction
    - WhisperGate
asset_type: Endpoint
mitre_attack_id:
    - T1036.003
    - T1218.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
id: 001266a6-9d5b-11eb-829b-acde48001122
version: 12
creation_date: '2021-04-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a source endpoint failing to authenticate with 30 unique invalid domain users using the Kerberos protocol. This detection leverages EventCode 4768, specifically looking for failure code 0x6, indicating the user is not found in the Kerberos database. This activity is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access or privilege escalation within the Active Directory environment, posing a significant security risk.
data_source:
    - Windows Event Log Security 4768
search: |-
    `wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
      | bucket span=5m _time
      | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as user values(dest) as dest
        BY _time, IpAddress
      | where unique_accounts > 30
      | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
references:
    - https://attack.mitre.org/techniques/T1110/003/
finding:
    title: Potential Kerberos based password spraying attack from $IpAddress$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: IpAddress
      type: ip_address
analytic_story:
    - Active Directory Password Spraying
    - Active Directory Kerberos Attacks
    - Volt Typhoon
asset_type: Endpoint
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Potato Privilege Escalation Tool Execution
id: cfde2a20-3737-4760-8498-16e1e6d1672d
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path.
    A tool class that has been a dominant post-compromise privilege escalation method for over a decade and remains actively used by ransomware operators, red teams, and nation-state actors alike.
    The Potato family exploits Windows token impersonation and privilege abuse to escalate from a service account, IIS worker process, or other restricted context to SYSTEM.
    The core abuse chain across most variants involves tricking a SYSTEM-level process into authenticating to an attacker-controlled endpoint, capturing that authentication, and impersonating the resulting SYSTEM token to spawn an elevated process.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats summariesonly=false allow_old_summaries=true
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.original_file_name IN (
        "*CertPotato*",
        "*CoercedPotato*",
        "*GenericPotato*",
        "*GhostPotato*",
        "*GodPotato*",
        "*HotPotato*",
        "*JuicyPotato*",
        "*LocalPotato*",
        "*LonelyPotato*",
        "*RoguePotato*",
        "*RottenPotato*",
        "*SharpPotato*",
        "*SweetPotato*"
    )
    OR Processes.process_path IN (
        "*CertPotato*",
        "*CoercedPotato*",
        "*GenericPotato*",
        "*GhostPotato*",
        "*GodPotato*",
        "*HotPotato*",
        "*JuicyPotato*",
        "*LocalPotato*",
        "*LonelyPotato*",
        "*RoguePotato*",
        "*RottenPotato*",
        "*SharpPotato*",
        "*SweetPotato*"
    )

    by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
       Processes.parent_process_name Processes.parent_process_exec Processes.action
       Processes.dest Processes.process_current_directory Processes.process_path
       Processes.process_integrity_level Processes.original_file_name Processes.parent_process
       Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id
       Processes.process_guid Processes.process_id Processes.user Processes.process_name

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_potato_privilege_escalation_tool_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate security tools or authorized pentesting software may use potato privilege escalation methods for testing purposes. Filter alerts based on approved security testing activities.
references:
    - https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all
finding:
    title: Potential Potato Privilege Escalation Tools activity observed on $dest$ via $process$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Service Create SliverC2
id: 89dad3ee-57ec-43dc-9044-131c4edd663f
version: 12
creation_date: '2023-03-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.
data_source:
    - Windows Event Log System 7045
search: |-
    `wineventlog_system` EventCode=7045 ServiceName="sliver"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer EventCode ImagePath
           ServiceName ServiceType
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_service_create_sliverc2_filter`
how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged from the System Event log. The Windows TA for Splunk is also recommended.
known_false_positives: False positives should be limited, but if another service out there is named Sliver, filtering may be needed.
references:
    - https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16
    - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
    - https://regex101.com/r/DWkkXm/1
finding:
    title: A user mode service was created on $dest$ related to SliverC2.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - BishopFox Sliver Adversary Emulation Framework
    - Compromised Windows Host
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1569.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Sqlservr Spawning Shell
id: d33aac9f-030c-4830-8701-0c2dd75bb6cb
version: 7
creation_date: '2025-02-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This analytic detects instances where the sqlservr.exe process spawns a command shell (cmd.exe) or PowerShell process. This behavior is often indicative of command execution initiated from within the SQL Server process, potentially due to exploitation of SQL injection vulnerabilities or the use of extended stored procedures like xp_cmdshell.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.parent_process_name="sqlservr.exe" `process_cmd`
        OR
        `process_powershell`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_sqlservr_spawning_shell_filter`
how_to_implement: To implement this detection, you need to be ingesting endpoint data that captures process creation events, specifically the parent-child process relationships. Ensure that you are collecting Sysmon Event ID 1 or Windows Event Log Security 4688 events. The data should be mapped to the Endpoint data model in Splunk.
known_false_positives: Legitimate administrative activities or monitoring tools might occasionally spawn command shells from sqlservr.exe. Review the process command-line arguments and consider filtering out known legitimate processes or users.
references:
    - https://attack.mitre.org/techniques/T1505/001/
    - https://github.com/MHaggis/notes/tree/master/utilities/SQLSSTT
analytic_story:
    - SQL Server Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1505.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WS FTP Remote Code Execution
id: b84e8f39-4e7b-4d4f-9e7c-fcd29a227845
version: 11
creation_date: '2023-10-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |-
    The following analytic detects potential Remote Code Execution (RCE) attempts exploiting CVE-2023-40044 in WS_FTP software.
    It identifies HTTP POST requests to the "/AHT/AhtApiService.asmx/AuthUser" URL with a status code of 200.
    This detection leverages the Web datamodel to monitor specific URL patterns and HTTP status codes. This activity is significant as it may indicate an exploitation attempt, potentially allowing an attacker to execute arbitrary code on the server.
    If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/AHT/AhtApiService.asmx/AuthUser"
    Web.status=200
    Web.http_method="POST"

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ws_ftp_remote_code_execution_filter`
how_to_implement: |-
    The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
known_false_positives: |-
    If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment.
    Note the MetaSploit module is focused on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL.
references:
    - https://github.com/projectdiscovery/nuclei-templates/pull/8296/files
    - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
    - https://github.com/rapid7/metasploit-framework/pull/18414
finding:
    title: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$ from $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - WS FTP Server Critical Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2023-40044
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network