Windows TeamCity Plugin Installed

name: Windows TeamCity Plugin Installed
id: 2fd33fb6-8c72-4e88-869f-b3b516f9f37e
version: 2
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects the creation of a plugin zip file under the TeamCity data structure.
    This indicates a new plugin has been installed and can potentially indicate attempts to gain code execution on the TeamCity server if the plugin installation was unexpected.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    
    from datamodel=Endpoint.Filesystem where
    
    Filesystem.file_path="*:\\ProgramData\\JetBrains\\TeamCity\\plugins\\*"
    Filesystem.file_name="*.zip"
    Filesystem.action="created"
    
    by Filesystem.dest Filesystem.action Filesystem.file_name Filesystem.user
       Filesystem.vendor_product Filesystem.file_create_time Filesystem.process_path
       Filesystem.process_guid Filesystem.process_id Filesystem.file_path
    
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_teamcity_plugin_installed_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate plugin installations by authorized administrators can trigger this detection. Verify with change management records before investigating further.
references:
    - https://thehackernews.com/2024/03/critical-jetbrains-teamcity-on-premises.html
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
drilldown_searches:
    - earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
      name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A TeamCity plugin archive was created at $file_path$ on $dest$.
threat_objects:
    - field: file_path
      type: file_path
analytic_story:
    - JetBrains TeamCity Vulnerabilities
    - JetBrains TeamCity Unauthenticated RCE
asset_type: Endpoint
mitre_attack_id:
    - T1505.003
    - T1059
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/snapattack/snapattack.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit