Splunk rules: 3j

name: AWS Credential Access RDS Password reset
id: 6153c5ea-ed30-4878-81e6-21ecdb198189
version: 13
creation_date: '2022-08-07'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs to identify events where the `ModifyDBInstance` API call includes a new `masterUserPassword` parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.
data_source:
    - AWS CloudTrail ModifyDBInstance
search: |-
    `cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=*
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_credential_access_rds_password_reset_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: Users may genuinely reset the RDS password.
references:
    - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
finding:
    title: $database_id$ password has been reset from IP $src$
    entity:
        field: database_id
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1110
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Duo Policy Bypass 2FA
id: 65862e8a-799a-4509-ae1c-4602aa139580
version: 6
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects instances where a Duo policy is created or updated to allow access without two-factor authentication (2FA). It identifies this behavior by searching Duo administrator activity logs for policy changes that set the authentication status to "Allow access without 2FA." By monitoring for these specific actions, the analytic highlights potential attempts to weaken authentication controls, which could be indicative of malicious activity or insider threats. This behavior is critical for a SOC to identify, as bypassing 2FA significantly reduces the security posture of an organization, making it easier for attackers to gain unauthorized access to sensitive systems and data. Detecting and responding to such policy changes promptly helps prevent potential account compromise and mitigates the risk of broader security breaches.
data_source:
    - Cisco Duo Administrator
search: |-
    `cisco_duo_administrator` action=policy_update OR action=policy_create
      | spath input=description
      | search auth_status="Allow access without 2FA"
      | rename object as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY action actionlabel description
           user admin_email
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `cisco_duo_policy_bypass_2fa_filter`
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A policy has been created or updated to allow access without 2FA by user $user$ with email $admin_email$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0
version: 6
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects suspicious use of `rundll32.exe` in combination with `mshtml.dll` and the export `RunHTMLApplication`.
    This behavior is often observed in malware to execute JavaScript or VBScript in memory, enabling payload staging or
    bypassing script execution policies and bypassing the usage of the "mshta.exe" binary.
    The detection leverages Cisco Network Visibility Module telemetry which offers network flow activity
    along with process information such as command-line arguments
    If confirmed malicious, this activity may indicate initial access or payload download.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    process_name = "rundll32.exe"
    process_arguments = "*mshtml*"
    process_arguments IN ("*135*", "*RunHTMLApplication*")
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
    - https://redcanary.com/blog/threat-detection/threat-research-questions/
    - https://twitter.com/n1nj4sec/status/1421190238081277959
    - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
    - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: $process_path$ was executed on $src$ leveraging the mshtml.dll and the RunHTMLApplication export to download a potentially suspicious file from $dest_hostname$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 12
creation_date: '2020-08-06'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
data_source:
    - AWS Security Hub
search: |-
    `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance
      | bucket span=4h _time
      | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity
        BY _time dest
      | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
      | eval threshold_value = 3
      | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0)
      | search isOutlier=1
      | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg
      | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
analytic_story:
    - AWS Security Hub Alerts
    - Critical Alerts
asset_type: AWS Instance
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Get DomainPolicy with Powershell Script Block
id: a360d2b2-065a-11ec-b0bf-acde48001122
version: 11
creation_date: '2021-08-27'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainPolicy` cmdlet using PowerShell Script Block Logging (EventCode=4104). It leverages logs capturing script block text to identify attempts to obtain the password policy in a Windows domain. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this behavior could lead to detailed knowledge of domain security settings, aiding in privilege escalation or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_domainpolicy_with_powershell_script_block_filter`
how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
    - https://attack.mitre.org/techniques/T1201/
finding:
    title: Powershell process indicative of querying domain policy, spawned by $user_id$ on $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Powershell process indicative of querying domain policy, spawned by $user_id$ on $dest$
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1201
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Headless Browser Mockbin or Mocky Request
id: 94fc85a1-e55b-4265-95e1-4b66730e05c0
version: 12
creation_date: '2023-09-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects headless browser activity accessing mockbin.org or mocky.io. It identifies processes with the "--headless" and "--disable-gpu" command line arguments, along with references to mockbin.org or mocky.io. This behavior is significant as headless browsers are often used for automated tasks, including malicious activities like web scraping or automated attacks. If confirmed malicious, this activity could indicate an attempt to bypass traditional browser security measures, potentially leading to data exfiltration or further exploitation of web applications.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.process="*--headless*"
            AND
            Processes.process="*--disable-gpu*"
            AND
            (Processes.process="*mockbin.org/*"
            OR
            Processes.process="*mocky.io/*")
        )
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `headless_browser_mockbin_or_mocky_request_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives are not expected with this detection, unless within the organization there is a legitimate need for headless browsing accessing mockbin.org or mocky.io.
references:
    - https://mockbin.org/
    - https://www.mocky.io/
finding:
    title: Headless browser activity accessing mockbin.org or mocky.io detected on $dest$ by $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Headless browser activity accessing mockbin.org or mocky.io detected on $dest$ by $user$.
analytic_story:
    - Forest Blizzard
    - GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
    - T1564.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
id: fbcc04c7-8a79-453c-b3a9-c232c423bdd3
version: 10
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects attempts to exploit the CVE-2024-27198 vulnerability in JetBrains TeamCity on-premises servers, which allows attackers to bypass authentication mechanisms. It leverages Suricata HTTP traffic logs to identify suspicious POST requests to the `/app/rest/users` and `/app/rest/users/id:1/tokens` endpoints. This activity is significant because it can lead to unauthorized administrative access, enabling attackers to gain full control over the TeamCity server, including projects, builds, agents, and artifacts. If confirmed malicious, this could result in severe security breaches and compromise the integrity of the development environment.
data_source:
    - Suricata
search: |-
    `suricata` ((http.url="*?jsp=*" AND http.url="*;.jsp*") http.status=200 http_method=POST) OR (http.url IN ("*jsp=/app/rest/users;.jsp","*?jsp=/app/rest/users;.jsp","*?jsp=.*/app/rest/users/id:*/tokens;*") http.status=200 http_method=POST )
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY src, dest, http.http_user_agent,
           http.url, http.status,http_method
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter`
how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
known_false_positives: False positives are not expected, as this detection is based on the presence of specific URI paths and HTTP methods that are indicative of the CVE-2024-27198 vulnerability exploitation. Monitor, filter and tune as needed based on organization log sources.
references:
    - https://github.com/projectdiscovery/nuclei-templates/pull/9279/files
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
    - https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
    - https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
finding:
    title: Possible JetBrains TeamCity Authentication Bypass Attempt against $dest$ from $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - JetBrains TeamCity Vulnerabilities
    - Hellcat Ransomware
asset_type: Web Server
cve:
    - CVE-2024-27198
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

id: '1109.1180'
title: Kerberos Weak Encryption Methods
description: 'RC4 and DES encryption have known vulnerabilities and can be cracked
  by determined adversaries in a relatively short time. Their active use in a network
  puts credentials at risk. -- Threat Actor Association: FIN6, Muddled Libra, Wizard
  Spider - Software Association: Conti, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4768) OR
  "<EventID>4768<" OR TERM(EventCode=4769) OR "<EventID>4769<") AND ( TERM(0x17) OR
  TERM(0x18) OR TERM(0x1) OR TERM(0x3) ) | regex "(i?)Ticket Encryption Type:\s+(0x17|0x18|0x1|0x3)"
  | rename Logon_GUID as guid, Client_Address as client_ip, Client_Port as client_port,
  Service_Name as user, Account_Domain as domain| rex field=_raw "Ticket Encryption
  Type:\s+"(?<encryption_type>"0x\d+") | table _time, host, user action, client_ip,
  client_port, domain, event_id, encryption_type, guid, service_name, signature_id,
  user | bin span=1s | stats values(*) as * by _time, host, encryption_type '
techniques:
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558.003
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/archive/blogs/motiba/detecting-kerberoasting-activity-using-azure-security-center
- https://dirteam.com/sander/2014/07/15/security-thoughts-leveraging-ntlm-hashes-using-kerberos-rc4-hmac-encryption-aka-aorato-s-active-directory-vulnerability/
- https://tools.ietf.org/html/rfc6649

name: Linux Auditd Auditd Daemon Abort
id: 76d6573f-c4ab-4fa1-8390-c036416d4add
version: 6
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_END, and system logs to determine root cause. If no DAEMON_START follows soon after, or this pattern repeats, it indicates a high-severity issue that impacts log integrity and should be immediately investigated.
data_source:
    - Linux Auditd Daemon Abort
search: |-
    `linux_auditd` type=DAEMON_ABORT
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY type op res
           uid dest pid
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_auditd_daemon_abort_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/6/html/security_guide/sec-audit_record_types
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Auditd service event - [$type$] event occurred on host - [$dest$].
analytic_story:
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1685.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux High Frequency Of File Deletion In Etc Folder
id: 9d867448-2aff-4d07-876c-89409a752ff8
version: 12
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. It leverages the Endpoint.Filesystem data model to identify instances where 200 or more files are deleted within an hour, grouped by process name and process ID. This behavior is significant as it may indicate the presence of wiper malware, such as AcidRain, which aims to delete critical system files. If confirmed malicious, this activity could lead to severe system instability, data loss, and potential disruption of services.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` values(Filesystem.file_access_time) as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) as file_name values(Filesystem.file_path) as file_path  values(Filesystem.file_acl) as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) as process_id values(Filesystem.user) as user dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted Filesystem.file_path = "/etc/*"
      BY _time span=1h Filesystem.dest
         Filesystem.process_guid Filesystem.action Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | where  numOfDelFilePath >= 200
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Multiple files delted in /etc/ folder on $dest$ by process GUID -  $process_guid$
analytic_story:
    - AcidRain
    - Data Destruction
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5998.18216'
title: Logon Script Registry Key added
description: 'Adversaries may use Windows logon scripts automatically executed at
  logon initialization to establish persistence. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (("EventCode=12" OR "<EventID>12<"
  OR "EventCode=13" OR "<EventID>13<") OR ("EventCode=1" OR "<EventID>1<" OR (TERM(reg)
  OR "reg.exe"))) "UserInitMprLogonScript" | table _time, host, user process, process_*,
  singature_id, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon initialization scripts:logon script (windows)
- privilege-escalation:boot or logon initialization scripts:logon script (windows)
technique_id:
- T1037.001
data_category:
- Windows Sysmon
references:
- https://blog.morphisec.com/cobalt-gang-2.0

name: Network Traffic to Active Directory Web Services Protocol
id: 68a0056c-34cb-455f-b03d-df935ea62c4f
version: 11
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. It leverages network traffic logs, focusing on source and destination IP addresses, application names, and destination ports. This activity is significant as ADWS is used to manage Active Directory, and unauthorized access could indicate malicious intent. If confirmed malicious, an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment.
data_source:
    - Sysmon EventID 3
search: |-
    | tstats count FROM datamodel=Network_Traffic
      WHERE All_Traffic.dest_port=9389
      BY All_Traffic.action All_Traffic.app All_Traffic.dest
         All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction
         All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version
         All_Traffic.src All_Traffic.src_ip All_Traffic.src_port
         All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `drop_dm_object_name("All_Traffic")`
    | `network_traffic_to_active_directory_web_services_protocol_filter`
how_to_implement: The detection is based on data that originates from network traffic logs. The logs must contain the source and destination IP addresses, the application name, and the destination port. The logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network traffic data source. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as the destination port is specific to Active Directory Web Services Protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the ADWS port. Filter by App or dest_ip to AD servers and remove known processes querying ADWS.
references:
    - https://github.com/FalconForceTeam/SOAPHound
analytic_story:
    - Windows Discovery Techniques
asset_type: Network
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '28613.52078'
title: Rundll32 Spawned by Disk Cleanup
description: The Windows Disk Cleanup utility is a legacy tool designed to delete
  cache and temporary files to improve system performance and free up hard disk space.
  It is possible to abuse the utility to establish persistence by executing arbitrary
  code when Disk Cleanup is initiated via COM hijacking. This use case detects rundll32.exe
  processes launched by CleanMgr.exe (Disk Cleanup binary), indicating potential COM
  hijacking has taken place. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "cleanmgr" "rundll32" | where match(parent_process_name, "(?i)cleanmgr\.exe") and
  match(process_name, "(?i)rundll32\.exe") | table _time, host, user, parent_*, process,
  process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:event triggered execution:component object model hijacking
technique_id:
- T1546.015
data_category:
- Windows Sysmon
references:
- https://pentestlab.blog/2024/01/29/persistence-disk-clean-up/
- https://cocomelonc.github.io/persistence/2022/11/16/malware-pers-19.html
- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/

name: Windows AD Dangerous Group ACL Modification
id: 59b0fc85-7a0d-4585-97ec-06a382801990
version: 10
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes",  "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties".  Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.'
data_source:
    - Windows Event Log Security 5136
search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"  | mvexpand new_ace  | where NOT new_ace IN (old_values)  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`'
how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
    - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
    - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
finding:
    title: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1222.001
    - T1484
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Impair Defense Disable Win Defender Gen reports
id: 93f114f6-cb1e-419b-ac3f-9e11a3045e70
version: 11
creation_date: '2024-01-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects modifications in the Windows registry to disable Windows Defender generic reports. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "DisableGenericRePorts" registry value. This activity is significant as it can prevent the transmission of error reports to Microsoft's Windows Error Reporting service, potentially hiding malicious activities. If confirmed malicious, this action could allow attackers to bypass Windows Defender detections, reducing the visibility of their activities and increasing the risk of undetected system compromise.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts" Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_gen_reports_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
references:
    - https://x.com/malmoeb/status/1742604217989415386?s=20
    - https://github.com/undergroundwires/privacy.sexy
finding:
    title: Windows Defender DisableGenericRePorts registry is set to enable on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Windows Defense Evasion Tactics
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Non-System Account Targeting Lsass
id: b1ce9a72-73cf-11ec-981b-acde48001122
version: 14
creation_date: '2022-01-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies non-SYSTEM accounts requesting access to lsass.exe. This detection leverages Sysmon EventCode 10 logs to monitor access attempts to the Local Security Authority Subsystem Service (lsass.exe) by non-SYSTEM users. This activity is significant as it may indicate credential dumping attempts or unauthorized access to sensitive credentials. If confirmed malicious, an attacker could potentially extract credentials from memory, leading to privilege escalation or lateral movement within the network. Immediate investigation is required to determine the legitimacy of the access request and to mitigate any potential threats.
data_source:
    - Sysmon EventID 10
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
known_false_positives: False positives will occur based on legitimate application requests, filter based on source image as needed.
references:
    - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
    - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
    - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
    - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
    - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
finding:
    title: A process, $parent_process_path$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: A process, $parent_process_path$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details.
threat_objects:
    - field: parent_process_path
      type: process
analytic_story:
    - CISA AA23-347A
    - Credential Dumping
    - Lokibot
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Phishing Recent ISO Exec Registry
id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c
version: 10
creation_date: '2022-08-30'
modification_date: '2026-05-13'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Hunting
description: The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_recent_iso_exec_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be high depending on the environment and consistent use of ISOs. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
references:
    - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
    - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
    - https://isc.sans.edu/diary/Recent+AZORult+activity/25120
    - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
analytic_story:
    - Brute Ratel C4
    - AgentTesla
    - Qakbot
    - IcedID
    - Azorult
    - Remcos
    - Warzone RAT
    - Gozi Malware
asset_type: Endpoint
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows SOAPHound Binary Execution
id: 8e53f839-e127-4d6d-a54d-a2f67044a57f
version: 13
creation_date: '2021-06-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the SOAPHound binary (`soaphound.exe`) with specific command-line arguments. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and other process-related metadata. This activity is significant because SOAPHound is a known tool used for credential dumping and other malicious activities. If confirmed malicious, this behavior could allow an attacker to extract sensitive information, escalate privileges, or persist within the environment, posing a severe threat to organizational security.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name="soaphound.exe"
        OR
        Processes.original_file_name="soaphound.exe"
        AND
        Processes.process IN ("*--buildcache *", "*--bhdump *", "*--certdump *", "*--dnsdump *", "*-c *", "*--cachefilename *", "*-o *", "*--outputdirectory *")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_soaphound_binary_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: False positives should be limited as the command-line arguments are specific to SOAPHound. Filter as needed.
references:
    - https://github.com/FalconForceTeam/SOAPHound
finding:
    title: The process $process_name$ was executed on $dest$ related to SOAPHound.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process_name
      type: process
analytic_story:
    - Windows Discovery Techniques
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1069.001
    - T1069.002
    - T1087.001
    - T1087.002
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: WinEvent Windows Task Scheduler Event Action Started
id: b3632472-310b-11ec-9aab-acde48001122
version: 13
creation_date: '2021-10-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of tasks registered in Windows Task Scheduler by monitoring EventID 200 (action run) and 201 (action completed) from the Task Scheduler logs. This detection leverages Task Scheduler logs to identify potentially suspicious or unauthorized task executions. Monitoring these events is significant for a SOC as it helps uncover evasive techniques used for persistence, unauthorized code execution, or other malicious activities. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or the execution of harmful payloads, posing a significant threat to the environment.
data_source:
    - Windows Event Log TaskScheduler 200
    - Windows Event Log TaskScheduler 201
search: '`wineventlog_task_scheduler` EventCode IN ("200","201")  | stats count min(_time) as firstTime max(_time) as lastTime by TaskName dvc EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winevent_windows_task_scheduler_event_action_started_filter`'
how_to_implement: Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
known_false_positives: False positives will be present. Filter based on ActionName paths or specify keywords of interest.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
analytic_story:
    - SolarWinds WHD RCE Post Exploitation
    - IcedID
    - BlackSuit Ransomware
    - Windows Persistence Techniques
    - Prestige Ransomware
    - Winter Vivern
    - CISA AA22-257A
    - Amadey
    - AsyncRAT
    - ValleyRAT
    - SystemBC
    - Malicious Inno Setup Loader
    - Scheduled Tasks
    - Data Destruction
    - CISA AA24-241A
    - DarkCrystal RAT
    - Qakbot
    - Sandworm Tools
    - Industroyer2
    - PlugX
    - Remcos
asset_type: Endpoint
mitre_attack_id:
    - T1053.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint